CVE-2026-104383
Received Received - Intake

Improper Code Injection in EagleCloud Aquila MFA

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Mandiant Inc.

Description
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-104383
EUVD
EUVD-2026-111587

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
EagleCloud Aquila 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper control of code generation in the Pigeon MFA service of EagleCloud Aquila versions up to 2.6.7.2. It allows authenticated remote attackers to execute arbitrary code through code injection. The flaw stems from an improperly restricted API endpoint that enables persistent injection of dynamic Lua scripts, which are then evaluated by backend execution engines.

Detection Guidance

Check Aquila version with 'curl -s http://<target>/api/version' or similar endpoint. Look for exposed API endpoints like '/api/execute' or '/api/script' that accept Lua code injection. Monitor logs for unexpected Lua script evaluations or unauthorized code execution attempts.

Impact Analysis

This vulnerability can lead to full system compromise and enterprise perimeter breaches. Attackers can exploit it without advanced techniques or victim interaction by leveraging exposed API endpoints directly from the internet or through edge proxies using leaked credentials. Successful exploitation grants root-level remote code execution.

Mitigation Strategies

Upgrade Aquila to version 2.6.7.3 or later immediately. Restrict access to API endpoints using network segmentation or firewalls. Rotate all credentials and audit for unauthorized access. Disable dynamic Lua script execution if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart