CVE-2026-16741

CVSS: 9.8v3.1CriticalReceived

Published 2026-10-14Last modified 2026-10-14

Open JSON

Vulnerability summary

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (cve.org)

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

2026-10-14
PublishedVulnerability first disclosed.
2026-10-14
Last modifiedVulnerability information updated.

Description

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.8

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Tr7 cyber defense inc.1 product

tr7 asp≥ 1.0.40.236, < 1.0.1554.2331 | ≥ 1.6.42.239, < 1.6.1554.2331

1 vendor · 1 product

References

1 links

siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1327Government Resource