PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6886 BorG Technology Corporation CVE debrief

A critical authentication bypass vulnerability in Borg SPM 2007, a sales performance management software whose sales ended in 2008, allows unauthenticated remote attackers to authenticate as any user. The vulnerability was published on April 23, 2026, and last modified on May 19, 2026. The product is no longer supported, and no patches are available. Organizations should remove or isolate affected systems immediately.

Vendor
BorG Technology Corporation
Product
Borg SPM 2007
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-23
Original CVE updated
2026-05-19
Advisory published
2026-04-23
Advisory updated
2026-05-19

Who should care

Organizations with legacy sales performance management infrastructure, particularly those in regions where Borg SPM 2007 may have been deployed; security teams managing end-of-life software inventories; compliance officers responsible for unsupported system risk documentation

Technical summary

Borg SPM 2007, developed by BorG Technology Corporation, contains an authentication bypass vulnerability (CWE-1390) that permits unauthenticated remote attackers to log into the system as arbitrary users. The product reached end-of-life when sales concluded in 2008, and no security patches are available. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects network accessibility, low attack complexity, and high impacts across confidentiality, integrity, and availability dimensions.

Defensive priority

critical

Recommended defensive actions

  • Immediately inventory and identify any remaining Borg SPM 2007 deployments
  • Remove or fully isolate affected systems from all networks
  • If isolation is required, implement strict network segmentation with deny-by-default rules
  • Monitor for unauthorized authentication events in legacy system logs
  • Document and escalate end-of-life software risk to security leadership

Evidence notes

Vulnerability details sourced from NVD with references to Taiwan CERT advisories. CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

Official resources

public