Which versions of Borg SPM 2007 are affected by EUVD-2026-25211?

Borg SPM 2007 contains a critical remote authentication bypass (CVSS 9.3) allowing unauthenticated attackers to impersonate any user and achieve complete system compromise over the network.

How to fix or mitigate EUVD-2026-25211?

Within 24 hours: Conduct inventory scan to identify any Borg SPM 2007 instances on the network and document business justification for continued operation. Within 7 days: Isolate identified systems from production networks via network segmentation or air-gapping if decommissioning is not immediately feasible. Within 30 days: Complete migration of functionality to supported alternatives and decommission all Borg SPM 2007 installations; if business-critical processes depend on this system, engage vendor for extended support options or archived patch review.

Borg SPM 2007 EUVD-2026-25211

Q: What is the CVSS score of EUVD-2026-25211?

EUVD-2026-25211 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-6886 CRITICAL

Weak Authentication (CWE-1390)

2026-04-23 twcert

GHSA-qxgc-wc3f-24c9

Authentication Bypass Borg Spm 2007 Borg Technology Corporation

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 10:30 vuln.today

CVSS changed

Apr 23, 2026 - 10:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 10:00 euvd

EUVD-2026-25211

Analysis Generated

Apr 23, 2026 - 10:00 vuln.today

CVE Published

Apr 23, 2026 - 09:25 nvd

CRITICAL 9.3

DescriptionCVE.org

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user.

AnalysisAI

Authentication bypass in Borg SPM 2007 allows remote unauthenticated attackers to impersonate any user and gain complete system access without credentials. This discontinued product (sales ended 2008) presents maximum network exposure (CVSS:4.0 9.3, AV:N/AC:L/PR:N) with trivial exploitation conditions. While no CISA KEV listing exists, the simplicity of exploitation combined with complete system compromise (VC:H/VI:H/VA:H) makes this critical for organizations still running this legacy software, though real-world deployment is likely minimal given the 18-year product discontinuation.

Technical ContextAI

CWE-1390 (Weak Authentication) indicates a fundamental flaw in the authentication mechanism of Borg SPM 2007, a sales and product management system developed by BorG Technology Corporation. The vulnerability exists in an end-of-life product where sales ceased in 2008, meaning no vendor support or security updates have been available for approximately 18 years. The authentication bypass likely stems from missing or improperly implemented authentication checks in the application layer, allowing attackers to craft requests that skip credential validation entirely. Based on the CPE (cpe:2.3:a:borg_technology_corporation:borg_spm_2007), all versions of this specific 2007 release are affected, though version granularity is not specified in available data.

RemediationAI

No vendor-released patch exists or will be developed for this end-of-life product discontinued in 2008. Immediate decommissioning and migration to actively supported sales/product management software is the only secure remediation path. Organizations still running Borg SPM 2007 should treat this as a critical migration priority: identify all instances in the environment, inventory dependent business processes, select a replacement system with current vendor support, plan data migration, and execute cutover within 30-60 days maximum. As interim emergency controls if immediate decommissioning is impossible: isolate affected systems on network segments with no internet access, implement strict IP allowlisting permitting only authenticated VPN connections from known administrator workstations (not a true fix given the authentication bypass, but reduces attack surface), deploy network-layer authentication through reverse proxy with separate credential validation (trade-off: adds operational complexity and may break application functionality), and implement continuous monitoring for unauthorized access attempts while migration proceeds. Consult Taiwan CERT advisories at https://www.twcert.org.tw/en/cp-139-10863-2f48e-2.html for additional guidance. All compensating controls are temporary measures only-system replacement is mandatory for security.