NewSoft｜NewSoftOA - OS Command Injection

The impact of this Command Injection vulnerability is severe. An attacker with local access to the NewSoftOA server can leverage this flaw to execute arbitrary commands with the privileges of the web server user. This could allow them to read sensitive data, modify system files, install malware, or even gain persistent access to the system. The ability to execute arbitrary commands effectively grants the attacker complete control over the affected server. Given the document management nature of NewSoftOA, data at risk includes sensitive documents, user credentials, and potentially financial information. Lateral movement within the network is also possible if the server has access to other systems.

Organizations using NewSoftOA for document management, particularly those with limited security controls or legacy configurations, are at significant risk. Shared hosting environments where multiple users share the same server are also particularly vulnerable, as an attacker could potentially exploit this vulnerability to gain access to other users' data.

• linux / server: Monitor system logs (journalctl) for suspicious process executions, particularly those originating from the NewSoftOA web server user. Look for unusual command-line arguments.

journalctl -u newsoftoa -f | grep -i 'command injection'

• windows / supply-chain: Monitor PowerShell execution logs for commands related to NewSoftOA. Check scheduled tasks for any suspicious entries.

Get-ScheduledTask | Where-Object {$_.TaskName -like '*newsoftoa*'} | Format-List TaskName, Actions

• generic web: Examine web server access logs for requests containing potentially malicious characters or patterns indicative of command injection attempts.

 grep -i 'command injection' /var/log/apache2/access.log

1. 2026-04-21Disclosure

   disclosure

1. 已保留2026-04-09
2. 发布日期2026-04-21
3. EPSS 更新日期2026-04-28

The primary mitigation for CVE-2026-5965 is to immediately upgrade NewSoftOA to version 10.1.8.3 or later. If upgrading is not immediately feasible, consider restricting local access to the server to only authorized personnel. Implement strict file system permissions to limit the potential damage from command execution. While a direct WAF rule is unlikely to be effective against this type of vulnerability, monitoring for unusual process execution patterns on the server can provide early detection. After upgrading, confirm the vulnerability is resolved by attempting a command injection payload in a controlled environment and verifying that it is properly sanitized.