CVE-2026-34007
MediumCVSS 6.9Summary
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in version 3.9.11 and later.
Risk Assessment
Arbitrary command execution may lead to full system compromise, data theft, or installation of malware.
Recommendation
Update Notes Station 3 to version 3.9.11 or later and restrict access to the application to trusted users only.
Other vulnerabilities in Notes Station 3
See all- CVE-2026-39991Medium
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. The vulnerability has been fixed in version 3.9.12 and later.
- CVE-2026-34009High
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
- CVE-2026-34008High
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
Original NVD description (English source)
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS