CVE-2026-6885
Published: 23 April 2026
Summary
CVE-2026-6885 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-6885 is an Arbitrary File Upload vulnerability in Borg SPM 2007, a product developed by BorG Technology Corporation with sales ending in 2008. Published on 2026-04-23T10:16:18.240, the flaw allows unauthenticated remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation grants high-impact remote code execution, compromising confidentiality, integrity, and availability of the affected server.
Mitigation details are outlined in advisories from TWCERT/CC, available at https://www.twcert.org.tw/en/cp-139-10863-2f48e-2.html and https://www.twcert.org.tw/tw/cp-132-10861-b8709-1.html.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25209
Vulnerability details
Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing web application enables unauthenticated RCE via exploitation of public-facing app (T1190) and direct facilitation of web shell deployment (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires identification, prioritization, and correction of the specific arbitrary file upload flaw, directly eliminating the vulnerability in Borg SPM 2007.
SI-10 mandates validation of information inputs, preventing unrestricted uploads of dangerous file types like executable web shells.
AC-3 enforces access control policies to require identification and authentication for file upload operations, blocking unauthenticated remote attackers.