The vulnerability allows unauthenticated remote attackers to inject arbitrary operating system commands into the SecuShare Pro server, resulting in the execution of those commands on the backend. The flaw exists in input handling that fails to sanitize command strings, allowing full remote code execution. The CWE associated with this weakness is OS Command Injection (CWE‑78).

Affected by the Openfind SecuShare Pro product. Cloud edition environments have been fully updated; no further action is required for those. Standard edition users must contact Openfind’s technical service team for assistance with the update. Customized editions need to verify the current system version and request the corresponding security patch from Openfind.

The CVSS score of 9.3 reflects a high‑severity vulnerability that can be exploited without authentication, providing attackers with unrestricted command execution on the server. The EPSS score of 0.01467 (~1.5%) indicates a low, but nonzero exploitation probability, though the lack of an authentication requirement still enables attackers to attempt exploitation when the vulnerable component is reachable. The flaw is not listed in the CISA KEV catalog, yet its severity and the nature of the attack vector warrant immediate attention. Unauthenticated attackers can reach the vulnerable endpoint over the network, so the attack surface is large and exploitation is straightforward once the vulnerable component is reachable.