OneUptime Command Injection Flaw Enables Full Server Takeover

Back Cyberpress

OneUptime Command Injection Flaw Enables Full Server Takeover

Cyberpress • March 2, 2026

Share: View original

Tracked as CVE-2026-27728, this flaw risks complete system compromise for organizations relying on versions before 10.0.7.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OneUptime Command Injection Vulnerability Allows Full Server Takeover A critical command injection vulnerability, tracked as CVE-2026-27728, has been identified in OneUptime, affecting versions prior to 10.0.7. This flaw enables authenticated users to execute arbitrary operating system commands on the Probe server, risking complete system compromise for organizations using the affected versions. Immediate patching is advised to mitigate this risk. 2 sources 43

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter