CVE-2026-6885 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Techno… | CVSS 9.8 CRITICAL

Description

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Metadata

CVE ID: CVE-2026-6885
State: PUBLISHED
Assigner: twcert
Reserved: 2026-04-23 02:43 UTC
Published: 2026-04-23 09:05 UTC
Last updated: 2026-04-23 12:23 UTC
Primary CWE: CWE-434
CWE-434 Unrestricted upload of file with dangerous type
Vendor / Product: BorG Technology Corporation / Borg SPM 2007
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
BorG Technology Corporation	Borg SPM 2007	—	—

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434 Unrestricted upload of file with dangerous type

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)