Cyber Posture

CVE-2026-4585

CriticalRCEUpdated

Published: 23 March 2026

Published
23 March 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 43.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4585 is a critical-severity Command Injection (CWE-77) vulnerability in Feishu (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires validation of the File argument to prevent OS command injection in the vulnerable JSP endpoint.

prevent

Ensures timely remediation of the disclosed and unpatched OS command injection flaw through patching or workarounds.

preventdetect

Boundary protection mechanisms like web application firewalls can block or detect remote command injection attempts targeting the exposed endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

CVE enables unauthenticated remote OS command injection via public-facing web application parameter manipulation, directly facilitating T1190 (Exploit Public-Facing Application) for initial access and T1059 (Command and Scripting Interpreter) for arbitrary command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipulation of the argument File leads to os command injection. The…

more

attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2026-4585 is an OS command injection vulnerability affecting the Tiandy Easy7 Integrated Management Platform up to version 7.17.0. The issue resides in unknown code within the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the Configuration Handler component, where manipulation of the File argument enables command injection. It is associated with CWE-77 and CWE-78.

The vulnerability allows remote exploitation without authentication, privileges, or user interaction, and with low attack complexity. Attackers can achieve high impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Advisories from VulDB indicate that the vendor was contacted early regarding the disclosure but provided no response. No patches or specific mitigations are detailed in the available information. Relevant references include https://vuldb.com/?ctiid.352422, https://vuldb.com/?id.352422, https://vuldb.com/?submit.775457, and https://my.feishu.cn/docx/WkHjd3oajoIw5exHk9ecUHaFnKd?from=from_copylink.

The exploit has been publicly disclosed and may be used by attackers.

Details

CWE(s)

Affected Products

Feishu
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2025-1546Shared CWE-77, CWE-78
CVE-2026-2952Shared CWE-77, CWE-78
CVE-2026-7062Shared CWE-77, CWE-78
CVE-2025-1536Shared CWE-77, CWE-78
CVE-2026-1544Shared CWE-77, CWE-78
CVE-2025-15501Shared CWE-77, CWE-78
CVE-2026-7698Shared CWE-77, CWE-78
CVE-2025-59740Shared CWE-77, CWE-78
CVE-2026-4170Shared CWE-77, CWE-78
CVE-2026-5972Shared CWE-77, CWE-78

References