CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-108540 — A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknow...

·Source: NIST NVD

Updated:

Executive Summary

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 9.9. Published: 2026-10-11T07:17:23.303.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108540
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 11, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-89111 — The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting mul...

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

CVE-2026-89111
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-89110 — SAP NetWeaver Visual Composer does not perform sufficient authorization checks i...

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

CVE-2026-89110
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-89108 — SAP Manufacturing Integration and Intelligence does not sufficiently enforce aut...

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative co

CVE-2026-89108
NIST NVD