Vulnerability · Published Jun 16, 2026 · Assigned by ENISA
CVE-2026-22313OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector
Critical 9.1
In plain English
A critical-severity OS command injection in iSAP Smart Collector from Radiflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.9%top 39.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Radiflow | iSAP Smart Collector | 3.07-1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22313 third-party-advisory