GCB Doctor CVE-2026-78211

The concrete prerequisite is that the vulnerable, un-removed ADOdb test page ships in the deployed build (any version before 20260621) and is reachable over the network; the attacker sends a crafted value in the specific test-page parameter that is passed to an OS command. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), there is no authentication, no user interaction, and no special attacker-side requirement - so against affected builds this is effectively unauthenticated remote exploitation with the only limiting factors being (1) network reachability of the GCB Doctor web interface and (2) the target running a build earlier than 20260621. Instances already updated to 20260621+ or with the test endpoint blocked/removed are not exploitable.

All available signals point to genuine high priority rather than an inflated CVSS number. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H describes remote, low-complexity, unauthenticated exploitation with no user interaction and full confidentiality, integrity and availability impact on the vulnerable system - consistent with the description of unauthenticated remote command execution. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so probabilistic and automatable-exploitation signals cannot be quantified; the absence of a KEV entry means there is no confirmation of active exploitation. No public exploit code was identified either, so the primary risk driver is the intrinsic ease of exploitation (no auth, no special config) combined with the availability of a fix that attackers can diff. Because command injection via a static endpoint is trivially scriptable, real-world risk should be treated as high despite the missing EPSS/KEV data.

An attacker scans for internet-exposed 4MOSAn GCB Doctor instances and requests the leftover ADOdb test page, supplying a parameter value containing an OS command separator followed by their payload (for example a reverse shell or reconnaissance command). Because the endpoint requires no authentication and the parameter is passed to the OS shell, the command executes on the server with the privileges of the web application, giving the attacker a foothold in a single unauthenticated request. No public POC is identified at this time, but the network vector and low attack complexity make weaponization straightforward.