CVE-2026-104383

Code injection in EagleCloud Aquila on-premises version

At a glance

Severity: CRITICAL 9.4
State: PUBLISHED
Published: 2026-10-28
Updated: 2026-10-28
Assigner: Mandiant

Description

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection

Scores

Version	Score	Vector	Scored by
CVSS 4.0	CRITICAL 9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	Mandiant

Weaknesses (CWE)

CWE-94

European references

ENISA EUVD · EUVD-2026-111587
GCVE · GCVE-0-2026-104383

Affected products

Product	Versions
EagleCloud · Aquila	affected 0 ≤ 2.6.7.2

References

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0039.md

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
ENISA EUVD	ENISA — reproduction authorised, source acknowledged