EagleCloud Aquila CVE-2026-104383

Exploitation requires authenticated low-privileged access to the Pigeon MFA service within an on-premises EagleCloud Aquila deployment running version 2.6.7.2 or earlier; the flaw is a code-injection (CWE-94) weakness in that specific service. The limiting factors are: valid credentials are needed (PR:L, so not anonymous/unauthenticated), the deployment must be the on-premises platform variant, and the version must be at or below 2.6.7.2. No user interaction is required (UI:N) and the service is reachable over the network (AV:N), so once an attacker holds any valid account the barrier to code execution is low. The precise injection trigger (which input field or feature) is not described in the available sources.

This is a genuine high-priority issue, and the available signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes low-complexity, network-reachable exploitation requiring only low-level authentication and no user interaction, with HIGH impact to confidentiality, integrity and availability on both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H), yielding a 9.4 critical score. The vuln.today decision label is act_now, and the finding was reported by Mandiant, a credible source, which raises confidence in the underlying technical claim. However, several exploitation signals are absent and must not be inflated: there is no CISA KEV listing, so this is NOT confirmed actively exploited; no EPSS score was supplied, so statistical exploitation probability cannot be quantified; and the sole reference is a Mandiant vulnerability-disclosure advisory, not verified working exploit code. The one limiting factor is the PR:L authentication requirement - an attacker needs valid low-privileged credentials to the Pigeon MFA service, which narrows the threat to insiders, credential-phishing outcomes, or chained access rather than pure anonymous internet exploitation. Net: treat as urgent per the act_now label, but recognize exploitation is authenticated and not yet confirmed in-the-wild.

An attacker who already holds low-privileged credentials to an on-premises EagleCloud Aquila deployment (version 2.6.7.2 or earlier) sends crafted input to the Pigeon MFA service that is improperly incorporated into generated code (CWE-94), achieving arbitrary code execution. Because the CVSS vector indicates network vector and low complexity with no user interaction, the request can be delivered remotely and reliably once authenticated. No public, verified exploit code is identified at time of analysis, though Mandiant has published a disclosure advisory.