Overview
CVE-2026-78211 is a critical OS command injection vulnerability in 4MOSAn GCB Doctor, a security management tool developed by 4MOSAn Security Technology. The flaw carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, placing it firmly in the most severe tier of vulnerabilities. An unauthenticated remote attacker can exploit this flaw to execute arbitrary operating system commands on the underlying host.
The vulnerability was published to the National Vulnerability Database (NVD) on August 24, 2026.
Technical Details
The root cause is a debug test page that was inadvertently left accessible in the production release. Specifically, an ADOdb (Active Data Objects DataBase) test page remains exposed and accepts unsanitized user input that is passed directly to OS-level operations. Because no authentication is required to reach this endpoint, the attack surface is effectively the network perimeter — any host that can reach the interface is a potential attacker.
| Attribute | Detail |
|---|---|
| CVE ID | CVE-2026-78211 |
| CWE | CWE-78 (Improper Neutralization of Special Elements used in an OS Command) |
| CVSS v3.1 | 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| CVSS v4.0 | 9.3 CRITICAL (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) |
| Attack Vector | Network |
| Authentication | None required |
| User Interaction | None required |
| Impact | Full confidentiality, integrity, and availability compromise |
Affected Versions
All versions of 4MOSAn GCB Doctor prior to build 20260621 (June 21, 2026) are affected. Organizations running any earlier build are vulnerable to unauthenticated remote code execution.
Remediation
Update immediately to build 20260621 or later. This release removes the exposed ADOdb test page that introduced the command injection surface.
If an immediate upgrade is not feasible, the following interim mitigations should be applied:
- Restrict network access — place the GCB Doctor management interface behind a firewall or VPN. Do not expose it to untrusted networks or the internet.
- Monitor for exploitation — look for unexpected process spawning, unusual outbound connections, or unauthorized account creation on hosts running GCB Doctor.
- Audit existing deployments — review whether the test page endpoint is currently accessible from untrusted segments.
Indicators of Compromise
Because this is an unauthenticated RCE, exploitation may leave traces such as:
- Unexpected child processes spawned by the GCB Doctor service
- Unusual outbound network connections to unknown destinations
- New user accounts or scheduled tasks created on affected hosts
- Web server access logs showing requests to ADOdb test paths