CVE-2026-7698
Published: 03 May 2026
Summary
CVE-2026-7698 is a medium-severity Command Injection (CWE-77) vulnerability in Feishu (inferred from references). Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability identified as CVE-2026-7698 affects Tiandy Easy7 Integrated Management Platform version 7.17.0. It resides in an unspecified function of the file /Easy7/rest/systemInfo/updateDbBackupInfo, where improper handling of the week argument enables OS command injection. The issue is tracked under CWE-77 and CWE-78, carries a CVSS 4.0 score of 5.5, and can be triggered remotely without authentication.
Remote, unauthenticated attackers can leverage the flaw to execute arbitrary operating system commands on the affected system. A publicly available exploit exists, and the vendor was notified prior to disclosure but provided no response or remediation.
The associated EPSS score remains low, with a current value of 0.0209 and a peak of 0.0214, indicating limited observed exploitation interest to date. The listed references consist primarily of vulnerability database entries and do not include vendor advisories or patch guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26836
Vulnerability details
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command injection. The attack can be executed remotely.…
more
The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in unauthenticated public-facing web endpoint directly enables T1190 (Exploit Public-Facing Application) and results in arbitrary OS command execution via T1059 (Command and Scripting Interpreter).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by validating the untrusted 'week' argument in the /Easy7/rest/systemInfo/updateDbBackupInfo endpoint.
Requires timely remediation of the identified command injection flaw in Tiandy Easy7 version 7.17.0 to eliminate exploitability.
Enforces authentication and authorization to block unauthenticated remote access to the vulnerable REST endpoint.