CVE-2026-74237: gfi software gfi clearview Argument Injection

Vulnerability summary

CVE-2026-74237 is a high (CVSS 7.1) Argument Injection vulnerability in gfi software gfi clearview. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.3% of scored vulnerabilities.

Timeline

1. 04-09-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.