CVE-2026-28409Disclosure(wegia / wegia)

LOWCVSS 7.2 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch wegia wegia systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.

wegia CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5m5g-q2vv-rv3r

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wegia

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
8 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 8 signals
Disclosure: 5 classified signals
Peaked 3d ago at 3 mentions (2026-02-28); latest day: 1
8 total mentions across 5 days

Affected systems

Vendors

wegia

Products

wegia

Deep dive

Activity timeline8 mentions / 5d

Signal classification2 categories

Disclosure

562.5%

Patch

337.5%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-27	2	Disclosure1Patch1
2026-02-28	3	Disclosure2Patch1
2026-03-02	1	Patch1
2026-03-04	1	Disclosure1
2026-04-21	1	Disclosure1

Full discourse8 posts

pdnuclei-bot@pdnuclei_bot169d
Disclosure
🚨 CVE-2026-28409 - critical 🚨 WeGIA <= 3.6.4 - Remote Code Execution > WeGIA <= 3.6.5 contains a remote code execution caused by improper validation of back... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-28409 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces CVE-2026-28409, a critical RCE vulnerability in WeGIA versions up to 3.6.4/5, and links to ProjectDiscovery for further details.
00011131
942 followersView on X
maru@maru1151157220d
Patch
🚨 CVE-2026-28409 (CVSS: 10.0) WeGIAのデータベース復元機能にRCE脆弱性。管理者アクセス可能場合、カスタムファイル名でバックアップアップロードにより任意のOSコマンド実行可能。バージョン3.6.5で修正。 https://maruomosquit.com/vulnerability/CVE-2026-28409/ #脆弱性 #セキュリティ
Post summary
CVE-2026-28409 is a critical RCE in WeGIA's database restore feature, fixed in version 3.6.5; no active exploitation or PoC reported.
00010142
1.4K followersView on X
The Hacker Wire@TheHackerWire222d
Disclosure
🔴 CVE-2026-28409 - Critical WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration fun... https://www.thehackerwire.com/vulnerability/CVE-2026-28409/ https://t.co/56kvjUtNKI
Post summary
The post announces a critical RCE vulnerability (CVE-2026-28409) in WeGIA before version 3.6.5, providing basic technical details but no PoC, exploit, patch, or evidence of active exploitation.
1000072
119 followersView on X
CRAC Learning - Tech@cracbot218d
Disclosure
CVE-2026-28409 (CVSS:10.0, CRITICAL) is Analyzed. WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulne..https://nvd.nist.gov/vuln/detail/CVE-2026-28409 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-28409, a critical RCE vulnerability in WeGIA prior to v3.6.5, with CVSS 10.0, but provides no exploit, patch, or active exploitation details.
0000043
173 followersView on X
PulsePatch.io@pulsepatchio222d
Patch
A critical RCE vulnerability (CVE-2026-28409) affecting `WeGIA` via OS command injection has been patched. Upgrade `WeGIA` to the latest fixed version. #WeGIA #RCE #InfoSec https://www.pulsepatch.io/posts/cve-2026-28409-wegia-remote-code-execution
Post summary
The post announces that CVE‑2026‑28409, a critical OS command injection RCE in WeGIA, has been patched and urges users to upgrade to the latest version.
0000060
1 followersView on X
CVE@CVEnew222d
Disclosure
CVE-2026-28409 WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's dat… https://www.cve.org/CVERecord?id=CVE-2026-28409
Post summary
The text announces a critical RCE vulnerability in WeGIA before version 3.6.5, providing basic technical details but no exploitation or mitigation information.
00000157
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds222d
Disclosure
CVE-2026-28409 Remote Code Execution in WeGIA Web Manager Prior to Version 3.6.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28409
Post summary
The text announces a remote code execution vulnerability affecting WeGIA Web Manager versions earlier than 3.6.5, with no additional exploitation details.
0000058
4.0K followersView on X
CVEFind.com@CveFindCom222d
Patch
[CVE-2026-28409: CRITICAL] Web manager WeGIA had a critical RCE vulnerability in versions before 3.6.5, allowing attackers to execute commands by uploading a malicious file. Update to secure your system.#cve,CVE-2026-28409,#cybersecurity https://cvefind.com/CVE-2026-28409
Post summary
A critical RCE vulnerability (CVE‑2026‑28409) affects WeGIA versions before 3.6.5, enabling attackers to execute commands by uploading a malicious file; users are urged to update to mitigate the risk.
0000062
585 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wegia	wegia	-	-	-

Explore more

Back to dashboard wegia CVEs wegia vulnerabilities

What researchers are saying

CVE-2026-28409

maru[verified]@maru1151157Patch

CVE-2026-28409 is a critical RCE in WeGIA's database restore feature, fixed in version 3.6.5; no active exploitation or PoC reported.

pdnuclei-bot@pdnuclei_botDisclosure

The post announces CVE-2026-28409, a critical RCE vulnerability in WeGIA versions up to 3.6.4/5, and links to ProjectDiscovery for further details.

The Hacker Wire@TheHackerWireDisclosure

The post announces a critical RCE vulnerability (CVE-2026-28409) in WeGIA before version 3.6.5, providing basic technical details but no PoC, exploit, patch, or evidence of active exploitation.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-28409, a critical RCE vulnerability in WeGIA prior to v3.6.5, with CVSS 10.0, but provides no exploit, patch, or active exploitation details.

PulsePatch.io@pulsepatchioPatch

The post announces that CVE‑2026‑28409, a critical OS command injection RCE in WeGIA, has been patched and urges users to upgrade to the latest version.

CVE@CVEnewDisclosure

The text announces a critical RCE vulnerability in WeGIA before version 3.6.5, providing basic technical details but no exploitation or mitigation information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces a remote code execution vulnerability affecting WeGIA Web Manager versions earlier than 3.6.5, with no additional exploitation details.

CVEFind.com@CveFindComPatch

A critical RCE vulnerability (CVE‑2026‑28409) affects WeGIA versions before 3.6.5, enabling attackers to execute commands by uploading a malicious file; users are urged to update to mitigate the risk.