EagleCloud Aquila CVE-2026-104384

Exploitation requires network reachability to the EagleCloud Aquila tunnel gateway or provisioning interfaces on an on-premises deployment running version 2.6.7.2 or earlier; the flaw is reached by abusing the authentication handling of those specific interfaces to read insufficiently protected stored credentials (access keys, secret keys, deployment secrets). Limiting factors: the vulnerable surface is the tunnel gateway/provisioning interfaces specifically and the issue is scoped to on-premises platforms and the affected version range, so environments that do not expose these interfaces to the attacker's network, or that run a fixed version, are not reachable; the precise authentication-abuse technique is not described in the available sources.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 8.7) describes a network-reachable, low-complexity flaw requiring no authentication and no user interaction, with impact confined to confidentiality of the vulnerable system (VC:H, VI:N, VA:N) - consistent with a CWE-522 Insufficiently Protected Credentials issue. The real-world weight comes from WHAT is exposed: access keys, secret keys, and deployment secrets, which are reusable credentials an attacker can leverage for follow-on compromise, so the single-dimension (confidentiality) impact understates downstream risk. The vuln.today decision label is 'this_week' (prioritize, but not act_now/emergency). Key exploitation signals are MISSING or absent in the input: no EPSS probability is provided, there is no CISA KEV listing, and no confirmed proof-of-concept - so exploitation likelihood cannot be quantified from the data given. The vulnerability was reported by Mandiant, which lends credibility to the technical finding, but credibility of the report is distinct from evidence of active exploitation. Net: this is a genuine priority (unauthenticated remote credential disclosure with lateral-movement potential), not a high-CVSS-but-low-real-risk issue, though urgency should track the 'this_week' label rather than be treated as an emergency given the absence of KEV and EPSS data.

A remote attacker with network reach to an on-premises EagleCloud Aquila tunnel gateway or provisioning interface abuses the authentication handling to retrieve stored access keys, secret keys, and deployment secrets without any credentials. Because CVSS indicates AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed to reach the interface. No public exploit identified at time of analysis; the only reference is a Mandiant disclosure advisory.