CVE-2026-6349: HGiga｜iSherlock - OS Command Injection

Published Apr 16, 2026

Updated

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

Affected Software

1 affected component

Hgiga iSherlock

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iSherlock-audit-4.5 to a version that resolves this vulnerability.
Fixed in 261
Upgrade
Upgrade iSherlock-audit-5.5 to a version that resolves this vulnerability.
Fixed in 261
Upgrade
Upgrade iSherlock-base-4.5 to a version that resolves this vulnerability.
Fixed in 476
Upgrade
Upgrade iSherlock-base-5.5 to a version that resolves this vulnerability.
Fixed in 476

Event History

Apr 16, 2026

CVE Published

via MITRE·02:24 AM

Data Sourced

via MITRE·02:24 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Feb 13, 58282

Event

via FIRST·07:48 PM

Frequently Asked Questions

What is the severity of CVE-2026-6349?

CVE-2026-6349 is classified as a critical severity vulnerability due to its potential for unauthorized command execution.

How do I fix CVE-2026-6349?

To address CVE-2026-6349, ensure that you update the iSherlock application to the latest version provided by HGiga that includes a patch for this vulnerability.

Who is affected by CVE-2026-6349?

All users of the HGiga iSherlock application are affected by CVE-2026-6349 if they have unpatched versions of the software.

Can CVE-2026-6349 be exploited remotely?

CVE-2026-6349 requires local access for exploitation, making it a local attack vector.

What are the potential consequences of CVE-2026-6349?

Exploitation of CVE-2026-6349 could lead to unauthorized execution of arbitrary OS commands, compromising server security and integrity.