Cyber Posture

CVE-2026-1427

High

Published: 26 January 2026

Published
26 January 2026
Modified
11 March 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 32.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection in the WellChoose SSO portal by enforcing validity checks on authenticated user inputs before OS execution.

SI-2 Flaw Remediation good match
prevent

Ensures timely flaw remediation for the specific OS command injection vulnerability, patching the root cause in the SSO system.

AC-6 Least Privilege partial match
prevent

Limits damage from injected arbitrary OS commands by enforcing least privilege on the vulnerable portal's processes and accounts.

Security SummaryAI

CVE-2026-1427 is an OS command injection vulnerability (CWE-78) affecting the Single Sign-On Portal System developed by WellChoose. Published on 2026-01-26, it enables authenticated remote attackers to inject and execute arbitrary OS commands on the server. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and potential for significant impacts across confidentiality, integrity, and availability.

Attackers with low privileges, such as authenticated users, can exploit this remotely over the network without user interaction. By injecting malicious OS commands, they achieve arbitrary code execution on the server, granting high-level control that could lead to data theft, system modification, or disruption.

TWCERT/CC advisories detail the vulnerability at https://www.twcert.org.tw/en/cp-139-10655-59160-2.html and https://www.twcert.org.tw/tw/cp-132-10654-23f40-1.html.

Details

CWE(s)
CWE-78

Affected Products

wellchoose
single sign-on portal system
≤ iftop_p4_181

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

OS command injection in a remote SSO portal enables exploitation of public-facing application (T1190), arbitrary OS command execution (T1059), and privilege escalation from low-privileged authenticated access (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References