CVE-2026-108540

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

October 11, 2026

Last Seen

October 11, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical OS Command Injection Vulnerability in OpenSpug Spug69.8

A critical OS command injection vulnerability, CVE-2026-108540, has been identified in OpenSpug Spug versions up to 4.0.1, allowing remote attackers to execute arbitrary OS commands. This flaw affects the file transfer functionality (/exec/transfer) and requires low privileges for exploitation. Affe...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical OS Command Injection Vulnerability in OpenSpug Spug

4h ago·1 sources

Related Articles (2)

OpenSpug Spug CVE-2026-108540 - CVSS 9.9 RCE ThreatAft / 6h Attribute Value CVE CVE-2026-108540 CVSS 3.1 9.9 (Critical) CVSS 4.0 9.4 (Critical) CWE CWE-78 OS Command Injection / CWE-77 Command Injection Attack Vector Remote, low privileges required Affected Component /exec/transfer — File Transfer Exploitation Public PoC available Vendor Response None A public proof-of-concept exploit exists and the vendor has not responded to disclosure.

threataft.com·4h ago

CVE-2026-108540 - Exploits & Severity

Related Entities

Zero-day Exploit CVE-2026-66568 CVE-2026-108753 CVE-2026-108860 CWE-77 - Command Injection CWE-78 - OS Command Injection T1059 - Command and Scripting Interpreter OpenSpug Spug Critical OS Command Injection