This vulnerability (CVE-2026-14448) involves improper neutralization of special elements in OS commands within the system_certificates view of mbCONNECT24 version 1.0.0. An authenticated attacker with high privileges can perform OS command injection, potentially executing arbitrary commands on the underlying system. This can result in total compromise of confidentiality, integrity, and availability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the vulnerability is not related to a cloud service.

Exploitation allows a high privileged authenticated remote attacker to execute arbitrary OS commands, leading to total loss of confidentiality, integrity, and availability of the affected system. This represents a critical compromise of system security and trustworthiness.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privileged access to trusted users only and monitor for suspicious activity related to system_certificates view usage. Avoid exposing the affected functionality to untrusted networks or users.