[ CVE-2026-15027 · Published 23 Sep 2026 ]
Vulnerability in Changing CGServiSign
CVSS 8.8
EPSS 3%No fix listed yet
[ Description ]Official description
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.