CVE-2026-6644

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-664407.1Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.CVE-2026-664417.5Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.CVE-2026-664425.4Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.CVE-2026-664437.5Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.CVE-2026-664446.5Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.CVE-2026-664456.5Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.CVE-2026-664469.3Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.CVE-2026-664479.3Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.CVE-2026-664486.5Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.CVE-2026-664497.1Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.CVE-2026-66457.3An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. CVE-2026-664508.1Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
CVE-2026-6644: Critical severity, CVSS 9.1 | Vulnix