Code Injection Vulnerability in Pigeon MFA Service of EagleCloud Aquila Software
CVE-2026-104383

9.4CRITICAL

Key Information:

Vendor

Eaglecloud

Status
Aquila
Vendor
CVE Published:
28 October 2026

What is CVE-2026-104383?

The Pigeon MFA service in EagleCloud Aquila, up to version 2.6.7.2, is susceptible to a code injection vulnerability. This flaw allows authenticated remote attackers to manipulate the generation of code, potentially executing arbitrary code on affected systems. This vulnerability poses a serious threat as it could enable unauthorized access and control over systems using the affected versions, making it critical for users to update and secure their installations.

Affected Version(s)

Aquila on-premises 0 <= 2.6.7.2

References

https://github.com/mandiant/Vulnerability-Disclosures/blo...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.