A critical (CVSS 9.8) flaw in TR7 Cyber Defense Inc.'s TR7 ASP lets an attacker inject OS commands without authenticating, on both the virtual and physical appliance editions.
What Is It
CVE-2026-16740 is a missing-authentication-for-critical-function vulnerability (CWE-306) in TR7 ASP. The NVD description says the flaw "allows OS Command Injection." In practice, a sensitive function on the appliance can be reached without credentials and used to run operating-system commands.
USOM, Türkiye's national CERT ([email protected]), assigned the CVE. It was published on 2026-10-14 under advisory TR-26-1327. NVD lists its status as "Received," which means NVD has not finished its own analysis yet.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which gives a base score of 9.8 (Critical):
- Network-reachable, with low attack complexity
- No privileges and no user interaction required
- High impact on confidentiality, integrity and availability
Because no authentication is needed, anyone who can reach an exposed appliance over the network may be able to run OS commands on it. TR7 ASP is a security appliance, so a compromised unit could give an attacker a privileged position inside the network it is meant to protect.
Exploitation status: No CISA KEV entry for this CVE was available for this brief. KEV does not currently confirm active exploitation, and none of the supplied sources report exploitation in the wild.
What's Vulnerable
According to the NVD record, these TR7 ASP builds are affected:
| Platform | Affected Versions |
|---|---|
| Virtual appliance | 1.0.40.236 up to (not including) 1.0.1554.2331 |
| Physical appliance | 1.6.42.239 up to (not including) 1.6.1554.2331 |
The record marks all other versions as unaffected by default. NVD has not yet published CPE data for this CVE.
Patch Status
The affected ranges end before 1.0.1554.2331 (virtual appliance) and 1.6.1554.2331 (physical appliance), so those builds are the first ones outside the vulnerable range. Owners of TR7 ASP should:
- Check which version their appliances run against the ranges above
- Upgrade to 1.0.1554.2331 / 1.6.1554.2331 or later
- Read USOM advisory TR-26-1327 for vendor guidance
No CISA KEV entry exists for this CVE, so CISA has not issued a required action or federal remediation deadline.