Argument Injection Vulnerability in GFI Exinda AI Product

CVE-2026-74237

What is CVE-2026-74237?

The GFI Exinda AI product prior to version 7.6.5 is susceptible to an argument injection vulnerability that arises from improper sanitization of input parameters in the Tools Iperf Client feature. By manipulating the input provided to the web_tools_cmd() function, an attacker with low-level privileges can inject arbitrary iperf flags. This can lead to unauthorized access, allowing the attacker to read sensitive files from the system and send their content to a remote server. It is crucial for users to update their software to mitigate this security risk.

References