The flaw is a code injection vulnerability in the Pigeon MFA service of EagleCloud Aquila. An authenticated remote attacker can submit crafted input that is executed as code by the service. Successful exploitation lets the attacker gain the same privileges as the logged‑in user, potentially compromising the entire on‑premises installation and its data. The weakness is an improper control of code generation, classified as CWE‑94.

All EagleCloud Aquila on‑premises installations with a version up to and including 2.6.7.2 are impacted. No additional sub‑release details were provided; users should verify that their deployed version falls within the affected range.

The CVSS score of 9.4 signals critical severity. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, there is no evidence of known public exploitation at this time. The attack vector is inferred to be authenticated remote, meaning the attacker must first obtain legitimate credentials or session tokens to the Pigeon MFA service before injecting malicious code.