What is the CVSS score of CVE-2026-28409?

CVE-2026-28409 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Wegia are affected by CVE-2026-28409?

A critical remote code execution vulnerability (CVSS 10.0) affects WeGIA charitable institution management systems prior to version 3.6.5, allowing unauthenticated attackers to execute arbitrary code…

Is there a public PoC exploit available for CVE-2026-28409?

Yes, a public proof-of-concept exploit is available for CVE-2026-28409. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-28409?

Within 24 hours: Immediately disable or restrict access to WeGIA's database restoration functionality; isolate affected systems from production networks if running versions prior to 3.6.5; conduct urgent inventory of all WeGIA deployments and versions. Within 7 days: Monitor vendor communications for emergency patch release; implement network segmentation to limit lateral movement if compromise occurs; review access logs for exploitation attempts. Within 30 days: Upgrade to WeGIA 3.6.5 or later once available; conduct forensic analysis of systems for breach indicators; reset credentials for all accounts with database or system access.

Wegia CVE-2026-28409

CRITICAL

OS Command Injection (CWE-78)

2026-02-27 security-advisories@github.com

RCE Authentication Bypass Command Injection Wegia

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 03, 2026 - 18:20 vuln.today

Public exploit code

CVE Published

Feb 27, 2026 - 22:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.

AnalysisAI

Critical RCE via OS command injection in WeGIA before 3.6.5. Unauthenticated attackers can execute arbitrary commands on the server. CVSS 10.0 with PoC available.