Critical severity · published Oct 28, 2026
CVE-2026-104383
Code injection in EagleCloud Aquila on-premises version
New
9.4
CVSS
–
EPSS
No
On KEV
Description
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AQ
Aquila · EagleCloud
through 2.6.7.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104383
github.com
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0039.md
More from Aquila
8.7
CVE-2026-104384
Insufficiently protected credentials in EagleCloud Aquila on-premises version