PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6885 BorG Technology Corporation CVE debrief

A critical arbitrary file upload vulnerability in Borg SPM 2007, a product whose sales ended in 2008, allows unauthenticated remote attackers to upload and execute web shell backdoors, resulting in arbitrary code execution on affected servers. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Given the product's end-of-life status and the critical severity (CVSS 9.3), organizations should prioritize identifying and removing any remaining deployments of this software.

Vendor
BorG Technology Corporation
Product
Borg SPM 2007
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-23
Original CVE updated
2026-05-19
Advisory published
2026-04-23
Advisory updated
2026-05-19

Who should care

Organizations with legacy web applications, security teams managing end-of-life software inventories, incident responders investigating web shell compromises, and compliance officers responsible for software asset management and vulnerability remediation programs.

Technical summary

Borg SPM 2007 contains an unrestricted file upload vulnerability (CWE-434) that permits unauthenticated attackers to upload malicious files including web shells. Successful exploitation grants arbitrary code execution on the underlying server. The vulnerability requires no authentication and can be exploited over the network with low complexity. The affected product reached end-of-life status when sales ceased in 2008, eliminating any prospect of vendor-supplied security patches.

Defensive priority

critical

Recommended defensive actions

  • Identify any remaining deployments of Borg SPM 2007 within your environment through asset inventory and network scanning
  • Remove or isolate all instances of Borg SPM 2007 immediately as the product reached end-of-life in 2008 with no security patches available
  • Review web server logs for indicators of compromise including unexpected file uploads, web shell artifacts, or suspicious POST requests to upload endpoints
  • Implement network segmentation to restrict access to any systems that must temporarily remain operational until decommissioned
  • Deploy web application firewall rules to block common web shell file extensions and upload patterns as a temporary compensating control
  • Conduct forensic analysis of affected systems to identify potential backdoors or persistence mechanisms if compromise is suspected

Evidence notes

Vulnerability disclosed by Taiwan CERT (TWCERT) with official CVE record. CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. Product sales ended in 2008 per CVE description, indicating end-of-life status with no expected vendor patches.

Official resources

public