---
id: CVE-2026-108907
title: A vulnerability was determined in Netcore NR268 1.7.121109
summary: >-
  A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the
  function user_ok of the component CGI Execution. This manipulation causes
  improper authentication. The attack can be initiated remotely. The exploit has
  been pub…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-287
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:13.373'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108907'
references:
  - url: >-
      https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-boa-auth-fail-open.md
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-108907'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/977173'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416702'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416702/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.170Z'
---

## Overview

A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.