CVE-2026-16741 is a critical (CVSS 9.8) OS command injection flaw in TR7 Cyber Defense Inc.'s TR7 ASP, affecting both virtual and physical appliances.
What Is It
CVE-2026-16741 is an OS command injection vulnerability (CWE-78) in TR7 ASP from TR7 Cyber Defense Inc. The product does not properly neutralize special elements used in an OS command. That allows OS commands to be injected on affected appliances.
Türkiye's national CERT (USOM, [email protected]) reported the issue, and it was published to NVD on October 14, 2026. NVD lists its status as "Received," which means NVD has not yet run its own analysis.
Why It Matters
USOM rates the flaw 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. By that rating:
- Network-exploitable: an attacker can reach it remotely.
- Low attack complexity: no special conditions are needed.
- No privileges or user interaction required: an unauthenticated attacker can trigger it without anyone's help.
- High impact to confidentiality, integrity and availability.
TR7 ASP is a security appliance, so it often sits in a sensitive spot in the network. Command injection on a device like this could give an attacker a strong foothold.
Exploitation status: At the time of writing, this CVE was not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. Treat the flaw as high priority anyway, given its unauthenticated, network-reachable profile.
What's Vulnerable
The affected versions differ by deployment type:
| Platform | Affected Versions |
|---|---|
| TR7 ASP (virtual appliance) | 1.0.40.236 up to, but not including, 1.0.1554.2331 |
| TR7 ASP (physical appliance) | 1.6.42.239 up to, but not including, 1.6.1554.2331 |
The vendor's default status for versions outside these ranges is "unaffected." NVD has not yet assigned CPE entries.
Patch Status
The affected ranges end before 1.0.1554.2331 (virtual appliance) and 1.6.1554.2331 (physical appliance), so those builds and later are outside the affected scope. Administrators should:
- Identify all TR7 ASP deployments, both virtual and physical.
- Check the installed version against the ranges above.
- Upgrade affected appliances to 1.0.1554.2331 or later (virtual) or 1.6.1554.2331 or later (physical).
- Read the USOM advisory (TR-26-1327) for any further vendor guidance.
Because the CVE is not in the KEV catalog, CISA has not set a required action or due date for it. Check the catalog again, since entries can be added at any time.