HGiga OAKlouds CVE-2026-93468

No special conditions - remote unauthenticated exploitation against default configurations of HGiga OAKlouds Bulletin V3 (module builds below 107 for the 2.0 and 3.0 product lines). The only prerequisites are network reachability of the OAKlouds Bulletin web interface and a running vulnerable build; no authentication (PR:N), no user interaction (UI:N), and no non-default settings are required. Exploitation is limited only by the product's narrow deployment footprint and by upgrading to build 107 or later, which the vendor has released.

This is a genuinely high-priority issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a network-reachable, low-complexity, unauthenticated, no-interaction flaw with high confidentiality impact - a classic pre-auth arbitrary file read, which is directly consistent with the description ('Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files'). There is no signal conflict between the vector and the description. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no confirmed active exploitation or SSVC decision data; exploitation status is therefore 'no public exploit identified at time of analysis.' The low real-world footprint of HGiga OAKlouds (a Taiwan-market product) tempers the aggregate risk, but for any organization actually running the affected bulletin module, this should be patched promptly because path-traversal file reads are trivially weaponized (e.g., dumping config files or credentials) and a vendor patch already exists. Missing signals: EPSS, KEV, POC, and SSVC are all absent, so exploitation likelihood is inferred from the flaw class and unauthenticated network vector rather than measured.

An unauthenticated attacker sends a crafted HTTP request to the OAKlouds Bulletin V3 endpoint containing relative path traversal sequences (e.g., ../../) in a file/path parameter, causing the application to return the contents of arbitrary files on the host such as configuration files, database credentials, or OS files. No POC is publicly identified, but the low attack complexity (AC:L) and lack of authentication (PR:N) make reliable exploitation straightforward for anyone who can reach the web interface.