PT-2026-33915 · Newsoftoa · Newsoftoa

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-5965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NewSoftOA (affected versions not specified)

Description An OS Command Injection flaw allows unauthenticated local attackers to inject and execute arbitrary operating system commands on the server. This can lead to remote code execution, potentially serving as a pivot point for lateral movement within corporate networks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-5965

Affected Products

Newsoftoa

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5965 · Security Note
• https://twitter.com/CVEnew/status/2046571852840219036 · Twitter Post
• https://twcert.org.tw/en/cp-139-10857-c46f7-2.html · Note
• https://twitter.com/0dayPublishing/status/2046437478748365246 · Twitter Post
• https://twcert.org.tw/tw/cp-132-10856-4979f-1.html · Note
• https://twitter.com/OrizonCyber/status/2046446374405746875 · Twitter Post