CVE-2026-21719

CYBERSECURITY BRIEFING NOTE CVE-2026-21719 is an OS command injection vulnerability affecting CubeCart versions prior to 6.6.0 that allows authenticated administrators to execute arbitrary operating system commands. This vulnerability requires administrative privileges to exploit, limiting the immediate attack surface to trusted internal users or compromised admin accounts. The vulnerability carries a CVSS score of 7.2 (HIGH) with network-based attack vector and low complexity. The impact is severe, with potential for complete compromise of confidentiality, integrity, and availability through arbitrary command execution on the affected system. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and community attention remains low with an EPSS score of 0.0026, indicating minimal prevalence among observed exploits. Organizations running CubeCart should prioritize upgrading to version 6.6.0 or later as part of standard patch management procedures.