CVE Catalog
CVE-2026-67961
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk0.15%
5th percentile - higher than 5% of all known CVEs
Summary
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.
Risk Assessment
A local attacker could gain full control over the system, potentially leading to compromise of data integrity and confidentiality, and system takeover.
Recommendation
It is recommended to update O2OA to the latest version that includes security fixes and restrict local access to the system.
Original NVD description (English source)
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution.