CVE-2026-5965 | NewSoftOA developed by NewSoft has an OS Command Injection v… | CVSS 9.8 CRITICAL

Description

NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

Metadata

CVE ID: CVE-2026-5965
State: PUBLISHED
Assigner: twcert
Reserved: 2026-04-09 10:34 UTC
Published: 2026-04-21 03:32 UTC
Last updated: 2026-04-21 13:20 UTC
Primary CWE: CWE-78
CWE-78 Improper neutralization of special elements used in a…
Vendor / Product: NewSoft / NewSoftOA
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
NewSoft	NewSoftOA	—	0 < 10.1.8.3

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)