EagleCloud Aquila Code Injection and Credential Exposure

Remote code execution in EagleCloud Aquila on-premises deployments through 2.6.7.2 allows authenticated low-privileged attackers to inject and execute arbitrary code through the Pigeon MFA service. The flaw is rated CVSS 9.4 and assessed as network-reachable with no user interaction, so a valid low-privileged account is the main prerequisite. No CISA KEV entry or public exploit code was identified at time of analysis; the vuln.today decision label is act_now given the high impact and limited authentication requirement.

EagleCloud Aquila on-premises deployments through version 2.6.7.2 expose stored access keys, secret keys, and deployment secrets to unauthenticated remote attackers who abuse authentication handling in the tunnel gateway and provisioning interfaces. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) with impact confined to confidentiality (VC:H, VI:N, VA:N), matching an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - the disclosure describes the outcome as privilege escalation, but the measurable effect is read-only access to high-value credentials rather than modification of the system. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and the vulnerability is triaged as "this_week" priority; exploitation requires that the tunnel gateway or provisioning interfaces be network-reachable on an affected on-premises installation.