CVE-2026-74237: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in GFI Software GFI Exinda AI

CVE-2026-74237 is an argument injection vulnerability in GFI Exinda AI and ClearView prior to version 7.6.5. The vulnerability exists in the Tools Iperf Client functionality where the web_tools_cmd() function constructs an iperf command using user-supplied server and options parameters without proper sanitization. This allows an authenticated attacker with unprivileged access to inject arbitrary iperf flags, including the -F flag, enabling them to read arbitrary files from the system and exfiltrate their contents to an attacker-controlled server.

An authenticated attacker with the lowest privilege level can exploit this vulnerability to read arbitrary files on the affected system and transmit their contents externally. This can lead to unauthorized disclosure of sensitive information. The CVSS 4.0 base score is 7.1 (high severity), reflecting the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity related to the Tools Iperf Client feature. Avoid exposing this functionality to untrusted networks or users.