What is the CVSS score of CVE-2026-27947?

CVE-2026-27947 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Group Office are affected by CVE-2026-27947?

Group-Office users face authenticated remote code execution risks through malicious TNEF email attachments, potentially allowing attackers with valid credentials to execute arbitrary code and…

How to fix or mitigate CVE-2026-27947?

Within 24 hours: Identify all Group-Office instances and document current versions; disable TNEF attachment processing if possible or restrict access to trusted users only. Within 7 days: Implement email gateway scanning for TNEF attachments; segment Group-Office systems from critical infrastructure; enforce multi-factor authentication for all users. Within 30 days: Upgrade to patched versions (26.0.9, 25.0.87, or 6.8.154) as they become available; conduct access reviews for Group-Office administrative accounts.

Group Office CVE-2026-27947

HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-02-27 security-advisories@github.com

RCE Group Office

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 20:21 nvd

HIGH 8.8

DescriptionGitHub Advisory

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from winmail.dat and then invokes zip with a shell wildcard (*). Because extracted filenames are attacker-controlled, they can be interpreted as zip options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.

AnalysisAI

Group Office versions before 26.0.9, 25.0.87, and 6.8.154 allow authenticated attackers to execute arbitrary commands through maliciously crafted TNEF attachments, where attacker-controlled filenames in winmail.dat are processed unsafely with zip wildcard expansion. An attacker with valid credentials can exploit this to achieve remote code execution with full system privileges. No patch is currently available for affected deployments.

Technical ContextAI

Affects Group-Office. Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from winmail.dat and then invokes zip with a shell wildcard (*). Because extracted filenames are attacker-controlled, they can be interpreted as zip options and lead to arbitrary command execution. Versions 26