SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-47670

CRITICAL · CVSS 9.4 EPSS 1.71% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-23 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

DbGate versions 7.1.8 and earlier are susceptible to authenticated Remote Code Execution (RCE), allowing any user with valid credentials to execute arbitrary OS commands as root through an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The existing mitigation can be easily bypassed, posing a significant risk to systems running affected versions. Organizations using DbGate should prioritize upgrading to version 7.1.9 or later to mitigate this vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit remote code execution code execution
GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-47670
Severity
CRITICAL
CVSS
9.4
EPSS
1.71%

Original NVD Description

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.