轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202610-00000010

[內容說明]
網擎資訊產品SecuShare Pro存在1個重大資安漏洞(CVE-2026-107459，CVSS:9.8)，此漏洞為OS Command Injection漏洞，未經身分鑑別之遠端攻擊者可注入任意作業系統指令並於伺服器上執行。

[影響平台]
SecuShare Pro v4

[建議措施]
雲端版：MailCloud（含 EaaS）環境已全數完成更新，服務不受影響，使用者無需採取額外措施。 標準版：SecuShare Pro 用戶請聯繫網擎資訊技術服務團隊協助進行版本更新。 客製版：請確認目前使用之系統版本，並將版號提供予網擎資訊，由網擎資訊提供對應之安全性更新程式。

[參考資料]
1. https://www.twcert.org.tw/tw/cp-132-11254-9c206-1.html
Forwarded Taiwan Computer Network Crisis Coordination Center Cybersecurity Information Alert TWCERTCC-200-202610-00000010

[Description]
Openfind Information Technology's SecuShare Pro product has 1 critical security vulnerability (CVE-2026-107459, CVSS:9.8). This is an OS Command Injection vulnerability that allows unauthenticated remote attackers to inject arbitrary operating system commands and execute them on the server.

[Affected Platforms]
SecuShare Pro v4

[Recommended Measures]
Cloud Version: The MailCloud (including EaaS) environment has been fully updated, and the service is not affected. Users do not need to take any additional measures.
Standard Version: SecuShare Pro users should contact the Openfind Information Technology technical service team for assistance with version updates.
Customized Version: Please confirm the system version currently in use and provide the version number to Openfind Information Technology, which will provide the corresponding security update program.

[References]
1. https://www.twcert.org.tw/tw/cp-132-11254-9c206-1.html