Zero Radar
← feed
CriticalVulnerabilityCVE-2026-104383updated 28 Oct 2026, 08:24 UTC

EagleCloud Aquila MFA service lets logged-in users run code on the server

Someone who already has a login to the system could trick the multi-factor login service into running their own commands on the server. That could give them control of the machine.

Official, 2 sources
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Logged-in attackerAttacker already holds a valid account
  2. 2Malicious MFA inputCrafted input is sent to the Pigeon MFA service
  3. 3Code injectedService generates code that includes attacker commands
  4. 4Commands executeServer runs the attacker's code
  5. ResultAttacker controls the server

What happened

The Pigeon MFA service in EagleCloud Aquila, on-premises versions through 2.6.7.2, has an improper control of code generation flaw (code injection) that lets an authenticated remote attacker execute arbitrary code.

Why it is dangerous: An attacker with any valid account could take over the server, reading or changing data and potentially reaching other systems. Organizations running on-premises Aquila are at risk.

Are you affected?

You are affected if you run EagleCloud Aquila on-premises at version 2.6.7.2 or earlier with the Pigeon MFA service.

EagleCloud Aquila on-premises, versions through 2.6.7.2 (Pigeon MFA service)

What to do

  1. Check whether your Aquila on-premises version is 2.6.7.2 or earlier and whether Pigeon MFA is enabled
  2. Apply the fixed version from EagleCloud or the vendor advisory as soon as it is available
  3. Limit who holds user accounts on the platform and review accounts for unexpected access until patched

Timeline

  1. 28 Oct 2026, 05:16 UTC
    Publicly disclosed
  2. 28 Oct 2026, 05:16 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 05:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 08:24 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-104383 · GHSA-fw38-659r-v3m6
CVSS
9.4 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
28 Oct 2026, 05:16 UTC
On Zero Radar
28 Oct 2026, 05:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 08:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

EagleCloud Aquila MFA service lets logged-in users run code on the server · Zero Radar