CVE Intelligence
Analysis AI-assisted

CVE-2026-5965: NewSoftOA OS Command Injection

NewSoftOA, from NewSoft, has a critical OS command injection flaw (CWE-78) that the CNA TWCERT/CC describes as allowing unauthenticated attackers to run arbitrary commands on the server. The CVSS 3.1 base score is 9.8, and the record lists no affected or fixed versions. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

NewSoftOA, developed by NewSoft, contains an OS command injection vulnerability (CWE-78) tracked as CVE-2026-5965. The record describes it as allowing unauthenticated attackers to inject arbitrary operating system commands that are executed on the server.

Impact

  • The CVSS 3.1 base score is 9.8 (Critical), with high confidentiality, integrity and availability impact according to the vector.
  • The CNA, TWCERT/CC, also provides a CVSS 4.0 score of 9.3.
  • Inference: if exploited, command execution on the server could expose data, allow system changes or disrupt service, depending on the privileges of the application process and the deployment environment.

Affected products and versions

  • The record does not list affected or fixed product versions. Confirm the exact affected builds and any fixed releases with NewSoft and the TWCERT/CC advisory before making decisions.

Exploitation status

  • CISA KEV does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted. The record includes an EPSS probability of 0.02596 and a percentile of 0.84937; EPSS is a statistical estimate of exploitation likelihood and does not confirm activity.

Remediation and mitigation

  • Inventory all NewSoftOA instances, including those reachable only from internal networks.
  • Check the TWCERT/CC advisories for vendor guidance and apply any official update from NewSoft once you have verified it.
  • Until a fix is applied, restrict network access to the application to trusted hosts and limit the privileges of the service account that runs it.
  • Review how the product handles input in any custom integrations.

Detection guidance

  • Review web server and application logs for unusual requests with shell metacharacters or unexpected parameter values.
  • Monitor for unexpected child processes started by the NewSoftOA service or its runtime user.
  • Watch for new outbound connections and unexpected file changes on the application server.

Limitations of the available information

  • The description refers to local attackers, while the CVSS vector uses a network attack vector. The record does not resolve this inconsistency, so consult the advisories.
  • Affected versions, fixed versions and the technical details of the injection point are absent from the record.
  • Exploitation status beyond the KEV listing and EPSS value is unknown.

Frequently asked questions

What is CVE-2026-5965?

It is an OS command injection vulnerability (CWE-78) in NewSoftOA from NewSoft. According to the record, it allows unauthenticated attackers to run arbitrary operating system commands on the server.

How severe is this vulnerability?

The CVSS 3.1 base score is 9.8 (Critical), and the CNA also provides a CVSS 4.0 score of 9.3. Scores are taken as recorded in the sources consulted.

Is there a confirmed fix or affected version list?

The record does not list affected or fixed versions. Check the TWCERT/CC advisories and the vendor for current guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.