The CGServiSign software developed by Changing contains an OS Command Injection vulnerability (CWE-78) in version 1.0.23.1227. This flaw permits unauthenticated remote attackers to induce victims to visit crafted malicious web pages, which then inject arbitrary operating system commands through the local service interface. Successful exploitation results in command execution on the victim's local machine without requiring privileges or authentication. The vulnerability is publicly known and assigned CVE-2026-15027 with a CVSS 4.0 base score of 8.6, indicating high impact on confidentiality, integrity, and availability.

An attacker can remotely execute arbitrary OS commands on the victim's local computer without authentication by leveraging this vulnerability. This can lead to full compromise of the affected system, including data theft, system manipulation, or further malware deployment. The attack requires user interaction (visiting a malicious web page) but no privileges or prior access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should avoid visiting untrusted web pages and consider restricting access to the CGServiSign local service interface if possible.