Cyber Posture

CVE-2026-6885

Critical

Published: 23 April 2026

Published
23 April 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0025 48.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-2 requires identification, prioritization, and correction of the specific arbitrary file upload flaw, directly eliminating the vulnerability in Borg SPM 2007.

prevent

SI-10 mandates validation of information inputs, preventing unrestricted uploads of dangerous file types like executable web shells.

prevent

AC-3 enforces access control policies to require identification and authentication for file upload operations, blocking unauthenticated remote attackers.

Security SummaryAI

CVE-2026-6885 is an Arbitrary File Upload vulnerability in Borg SPM 2007, a product developed by BorG Technology Corporation with sales ending in 2008. Published on 2026-04-23T10:16:18.240, the flaw allows unauthenticated remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation grants high-impact remote code execution, compromising confidentiality, integrity, and availability of the affected server.

Mitigation details are outlined in advisories from TWCERT/CC, available at https://www.twcert.org.tw/en/cp-139-10863-2f48e-2.html and https://www.twcert.org.tw/tw/cp-132-10861-b8709-1.html.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Arbitrary file upload in public-facing web application enables unauthenticated RCE via exploitation of public-facing app (T1190) and direct facilitation of web shell deployment (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References