CVE-2026-104383

30th percentile - higher than 30% of all known CVEs

Improper Control of Generation of Code in the Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection.

An authenticated attacker can execute arbitrary code in the organization's environment, potentially leading to system compromise and further escalation.

Update EagleCloud Aquila to a version later than 2.6.7.2 or apply the vendor patch, and restrict access to the Pigeon MFA service.