CVE-2026-15027

HIGHCVSS 8.8

Description

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.

Timeline

Published:September 23rd, 2026 9:17 AM

Last modified:September 24th, 2026 2:45 PM

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

References & Reports

Advisories, patches, and third-party reports

https://www.twcert.org.tw/en/cp-139-11214-89281-2.html
https://www.twcert.org.tw/tw/cp-132-11213-28a81-1.html

Source: NIST NVD · Data may lag official sources by up to one minute