CVE-2026-5965 describes an OS Command Injection vulnerability in NewSoftOA, a product developed by NewSoft. This vulnerability arises from improper neutralization of special elements in OS commands (CWE-78), enabling unauthenticated local attackers to inject arbitrary commands and execute them on the affected server. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official remediation or patch from the vendor. No known exploits have been reported in the wild. The affected version is indicated as '0', and the product is not a cloud service, so remediation responsibility lies with the product users and vendor.

Successful exploitation allows unauthenticated local attackers to execute arbitrary OS commands on the server hosting NewSoftOA, potentially leading to full system compromise including data theft, modification, or service disruption. The CVSS score of 9.3 reflects critical impact on confidentiality, integrity, and availability. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or temporary fix is currently available, users should monitor vendor communications for updates. Until a fix is provided, restricting local access to trusted users and employing host-based intrusion prevention may reduce risk. Avoid exposing vulnerable instances to untrusted local users.