E Fence Vulnerability Advisory: RCE via File Upload & SQL Injection (CVE-2026-80235/80236/80237)

Vulnerability Overview Vulnerability Name: E Fence - 3 vulnerabilities present Release Date: 2026-08-26 Vulnerability IDs: - CVE-2026-80235 - CVE-2026-80236 - CVE-2026-80237 Affected Scope Affected Products: E Fence version 1.2.66 DB Ver.56 and earlier Vulnerability Description: - CVE-2026-80235 (Arbitrary File Upload): Unauthenticated remote attackers can upload and execute web backdoors, leading to arbitrary code execution on the server. - CVE-2026-80236 (SQL Injection): Unauthenticated remote attackers can exploit this vulnerability to access the file upload functionality and read database contents. - CVE-2026-80237 (Arbitrary File Upload): Authenticated remote attackers can upload and execute web backdoors, leading to arbitrary code execution on the server. Remediation Solution: Please upgrade to version 1.2.67 DB Ver.57 or later. Related Links CVE-2026-80235 CVE-2026-80236 CVE-2026-80237 Additional Information Vulnerability Reporters: Sideman (DEVCore), Limzw (DEVCore) Disclosure Date: 2026-08-26 Page Footer Information Last Updated: 2026-08-26 Total Page Views: 31,054,922 Contact Information E-mail: - TWCERT/CC Service Mailbox: cert_service(at)cert.org.tw - Corporate Security Incident Reporting Mailbox: int_report(at)cert.org.tw - CVE Reporting Mailbox: cve(at)cert.org.tw PGP KEY TWCERT/CC PGP Public Key Key ID: 0x1E9D1F1B Other TLP:CLEAR QR Code: TWCERT/CC Taiwan Computer Network Emergency Response and Coordination Center Copyright Information Copyright: © TWCERT/CC Taiwan Computer Network Emergency Response and Coordination Center 1998-2025 Recommended Resolution: 1024x768 or higher Navigation Bar News and Announcements Security Services Security Awareness Related Websites About Us Footer Privacy and Security Policy User Instructions Summary This page primarily introduces three vulnerabilities (CVE-2026-80235, CVE-2026-80236, CVE-2026-80237) existing in the E Fence software, detailing the impact and remediation for each vulnerability, and providing relevant contact information and copyright details.

Goal Reached Thanks to every supporter — we hit 100%!

E Fence Vulnerability Advisory: RCE via File Upload & SQL Injection (CVE-2026-80235/80236/80237)