Critical Command Injection in NewSoftOA: Unauthenticated RCE Risk

The National Vulnerability Database has issued an advisory for CVE-2026-5965, a critical OS Command Injection vulnerability found in NewSoftOA, developed by NewSoft. This flaw allows unauthenticated local attackers to inject and execute arbitrary OS commands on the server. With a CVSS score of 9.8 (CRITICAL), this vulnerability represents a severe risk.

The impact is absolute: unauthenticated attackers can achieve full compromise. This isn’t theoretical; it’s a direct path to remote code execution. Attackers will leverage this to establish persistence, pivot into the network, and exfiltrate data. The low attack complexity and lack of authentication make it an immediate target for opportunistic scanning and exploitation.

Defenders using NewSoftOA must prioritize patching or mitigation immediately. The threat actor’s calculus is simple here: find exposed instances, run a basic command injection, and you own the box. This is precisely the kind of vulnerability that moves from disclosure to active exploitation in days, not weeks.