Which versions of Borg SPM 2007 are affected by CVE-2026-6885?

Borg SPM 2007, a discontinued product, contains a critical remote code execution vulnerability (CVE-2026-6885, CVSS 9.3) that allows unauthenticated attackers to upload and execute malicious code…

How to fix or mitigate CVE-2026-6885?

Within 24 hours: Scan network infrastructure for active Borg SPM 2007 instances using port scanning and vulnerability assessment tools; isolate any discovered systems from internet-facing networks immediately. Within 7 days: Complete asset inventory of all Borg SPM 2007 systems; if business-critical, engage vendor support or third-party security firm for custom patching assessment; begin planning decommissioning timelines. Within 30 days: Execute migration to supported alternative products or decommission all Borg SPM 2007 instances; if retention is required, implement network segmentation, disable file upload functionality if possible, and deploy intrusion detection rules targeting CVE-2026-6885 exploitation patterns.

Borg SPM 2007 CVE-2026-6885

Q: What is the CVSS score of CVE-2026-6885?

CVE-2026-6885 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-25209 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-23 twcert

GHSA-4m3v-5p6w-fv99

RCE File Upload Borg Spm 2007 Borg Technology Corporation

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 10:30 vuln.today

CVSS changed

Apr 23, 2026 - 10:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 10:00 euvd

EUVD-2026-25209

Analysis Generated

Apr 23, 2026 - 10:00 vuln.today

CVE Published

Apr 23, 2026 - 09:05 nvd

CRITICAL 9.3

DescriptionCVE.org

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

AnalysisAI

Remote code execution in Borg SPM 2007 allows unauthenticated attackers to upload and execute web shell backdoors via unrestricted file upload vulnerability. This discontinued product (sales ended 2008) remains exploitable over the network with no authentication required, enabling full server compromise. CVSS 9.3 (Critical) with network vector, low complexity, and no privileges required. EPSS and KEV data not available for this CVE, but the trivial attack requirements (AV:N/AC:L/PR:N/UI:N) indicate high exploitability if exposed systems exist.

Technical ContextAI

This vulnerability exploits CWE-434 (Unrestricted Upload of File with Dangerous Type) in Borg SPM 2007, a sales and product management system developed by BorG Technology Corporation. The application fails to properly validate file types, extensions, or content during upload operations, allowing arbitrary file execution in the web server context. Per CPE data (cpe:2.3:a:borg_technology_corporation:borg_spm_2007), all versions of this 2007-era product are affected. As a legacy web application that predates modern secure development practices, it likely lacks input validation, content-type verification, and upload directory restrictions. Web shell backdoors uploaded through this vector can execute operating system commands with web server privileges, typically SYSTEM on Windows IIS or www-data/apache on Linux servers.

RemediationAI

No vendor-released patch exists or will be developed for this discontinued product (end-of-sales 2008). Organizations must immediately decommission Borg SPM 2007 and migrate to supported alternatives. As interim emergency measures if immediate decommissioning is impossible: restrict network access to the application using firewall rules allowing only specific trusted IP addresses (blocks AV:N attack vector but does not fix the vulnerability); implement web application firewall rules to block file upload requests to known upload endpoints (signature-based, bypassable by determined attackers); disable all file upload functionality at the web server level by removing write permissions to upload directories and blocking HTTP POST/PUT methods (breaks legitimate application features). Monitor web server logs for suspicious file extensions (.jsp, .asp, .aspx, .php, .war) and POST requests to upload endpoints. All mitigations are temporary stopgaps - the only secure remediation is product retirement. Consult TWCERT advisories at https://www.twcert.org.tw/en/cp-139-10863-2f48e-2.html for additional guidance.