Vulnerability · Published Oct 14, 2026 · Assigned by TR-CERT

CVE-2026-16741OS Command in TR7 Cyber Defense's TR7 ASP

Critical 9.8

In plain English

A critical-severity OS command injection in TR7 ASP from TR7 Cyber Defense Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.7%top 22.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

Affected products (as reported)

Vendor	Product	Versions
TR7 Cyber Defense Inc.	TR7 ASP	1.0.40.236 – before 1.0.1554.2331
TR7 Cyber Defense Inc.	TR7 ASP	1.6.42.239 – before 1.6.1554.2331

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1327 government-resource