CVE-2026-5965CWE-78

NewSoft｜NewSoftOA - OS Command Injection

Critical · published April 21, 2026

CVSS v4.0
9.3
EPSS
3%
Percentile
85.2
In the wild
Unconfirmed
What it is

NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02596 · 85.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-21T03:32Z
EPSS history
Timeline
  • 21 APR 03:32Z
    NewSoft｜NewSoftOA - OS Command Injection
    cvelistv5