CVE-2026-90444

CVE-2026-90444 is an operating system command injection flaw (CWE-78) in an authenticated file-transfer interface of a log-ingestion product; the provided data does not name the vendor or product, and the identifier was assigned by CISA ICS-CERT, indicating an ICS/OT vendor advisory. An attacker with valid low-privileged credentials uploads a file whose filename contains shell metacharacters, and an automated process later constructs and executes a system command using that filename, running attacker-supplied commands with the privileges of the ingestion process. Successful exploitation lets the attacker read and modify ingested log data, which can be used to hide attacker activity, and may provide a foothold for lateral movement within the internal network. Any deployment where the file-transfer interface is reachable by low-privileged authenticated accounts is affected; no affected version ranges are included in the provided data. No public proof-of-concept or exploitation has been reported, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Restrict the file-transfer interface to the minimum necessary accounts and enforce filename validation that rejects or strips shell metacharacters (e.g., ;, |, &, $, backticks) at upload time. Monitor the ingestion host for unexpected child processes spawned by the ingestion service and audit recently uploaded filenames for embedded command syntax. Since no fixed version is given, watch for the CISA ICS-CERT advisory for this CVE and apply the vendor patch it specifies.