Key points
- CVE-2026-108540 is rated Critical with a CVSS score of 9.4 by the NVD.
- The flaw affects OpenSpug versions up to 3.4.0 and 4.0.1, allowing remote code execution.
- The vendor did not respond to early contact regarding this disclosure, leaving users without an official patch.
The National Vulnerability Database has assigned a Critical severity rating to CVE-2026-108540, a remote code execution flaw in OpenSpug Spug. The vulnerability carries a CVSS score of 9.4, indicating that attackers can execute arbitrary operating system commands remotely. This exploit targets the File Transfer component, specifically within the /exec/transfer endpoint, allowing for OS command injection.
How it unfolded
- The NVD record identifies CVE-2026-108540 as affecting OpenSpug Spug versions up to 3.4.0 and 4.0.1, with a CVSS score of 9.4.
- The vulnerability is linked to CWE-78 and CWE-77, representing improper neutralization of special elements in OS commands and improper output neutralization.
- Researchers noted that the exploit code has been published and is available for use, increasing the immediate risk to deployed instances.
- The vendor was contacted early in the disclosure process but failed to respond, resulting in no official statement or patch release.
Who is affected
OpenSpug Spug versions 3.0, 3.1, 3.2, and 3.3 are explicitly listed as affected by this vulnerability. The NVD record also notes that versions up to 3.4.0 and 4.0.1 are impacted. The flaw resides in an unknown function within the /exec/transfer file of the File Transfer component. This means any system administrator running these versions of the IT automation platform is potentially exposed to remote attacks.
The lack of vendor response creates a significant gap in remediation guidance. System administrators cannot rely on an official update to resolve the issue. Instead, they must rely on the published exploit details to understand the attack vector. The remote nature of the exploit means that attackers do not need physical access or prior authentication to attempt exploitation, depending on the exposure of the /exec/transfer endpoint.
What happens next
With no fix confirmed by the vendor, the risk remains active for all unpatched installations. The publication of the exploit code suggests that malicious actors may already be scanning for vulnerable instances. System administrators must assess their exposure immediately. Since the vendor did not respond to early contact, there is no timeline for a security update. Organizations should consider isolating affected systems or restricting access to the file transfer component until a workaround or patch is available.
The NVD record provides two severity ratings for the same CVE: 9.4 Critical and 8.6 High. Both ratings confirm the serious nature of the OS command injection vulnerability. The weaknesses are classified as CWE-78 and CWE-77. This dual rating may reflect different assessment methodologies, but both indicate a high level of risk. Administrators should treat the 9.4 rating as the primary indicator of severity.
Background: Remote code execution vulnerabilities
Monitor for unexpected child processes, sudden spikes in outbound network traffic, and anomalous file creation. Combine static analysis with runtime behavior monitoring to catch execution attempts before they establish persistence or exfiltrate data.
Read the full guide: Detect Remote Code Execution: Signals, Tools, and Blind Spots
What to do and how to stay safe: OpenSpug
- Audit your OpenSpug Spug installations to determine if you are running versions 3.0 through 3.4.0 or 4.0.1, and isolate any vulnerable instances from untrusted networks.
- Restrict network access to the /exec/transfer endpoint using firewall rules or web application firewalls to prevent remote exploitation attempts.
- Monitor server logs for unusual command execution patterns or unauthorized file transfers that may indicate an active exploit attempt.
- Prepare to apply a vendor update once it is released, but do not assume a fix exists; verify any patch against the specific CVE-2026-108540 advisory.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of OpenSpug Spug are affected by CVE-2026-108540?
Versions 3.0, 3.1, 3.2, and 3.3 are explicitly affected, with the vulnerability impacting versions up to 3.4.0 and 4.0.1.
Is there a patch available for this vulnerability?
No, the vendor did not respond to early contact, and no fix has been confirmed or released by the vendor.
What is the CVSS score for CVE-2026-108540?
The NVD rates the vulnerability as Critical with a CVSS score of 9.4, though an 8.6 High rating is also recorded.
