INITIALIZING
📧 info@ciso.sa | 📱 +966550939344 | Riyadh, Kingdom of Saudi Arabia
🔧 Scheduled Maintenance — Saturday 2:00-4:00 AM AST. Some features may be temporarily unavailable.    ●   
💎
Pro Plan 50% Off Unlock all AI features, unlimited reports, and priority support. Upgrade
Search Center
ESC to close
Global phishing Multiple sectors HIGH 1h Global insider Cybersecurity Services CRITICAL 1h Global ransomware Multiple sectors (U.S. companies) CRITICAL 1h Global malware Financial Services, Cryptocurrency CRITICAL 2h Global malware Technology and Cloud Services HIGH 2h Global general Financial Services and E-commerce MEDIUM 2h Global data_breach Social Media and Communications CRITICAL 2h Global general Cybersecurity Operations HIGH 3h Global phishing Technology and Consumer Services HIGH 3h Global data_breach Multiple sectors HIGH 3h Global phishing Multiple sectors HIGH 1h Global insider Cybersecurity Services CRITICAL 1h Global ransomware Multiple sectors (U.S. companies) CRITICAL 1h Global malware Financial Services, Cryptocurrency CRITICAL 2h Global malware Technology and Cloud Services HIGH 2h Global general Financial Services and E-commerce MEDIUM 2h Global data_breach Social Media and Communications CRITICAL 2h Global general Cybersecurity Operations HIGH 3h Global phishing Technology and Consumer Services HIGH 3h Global data_breach Multiple sectors HIGH 3h Global phishing Multiple sectors HIGH 1h Global insider Cybersecurity Services CRITICAL 1h Global ransomware Multiple sectors (U.S. companies) CRITICAL 1h Global malware Financial Services, Cryptocurrency CRITICAL 2h Global malware Technology and Cloud Services HIGH 2h Global general Financial Services and E-commerce MEDIUM 2h Global data_breach Social Media and Communications CRITICAL 2h Global general Cybersecurity Operations HIGH 3h Global phishing Technology and Consumer Services HIGH 3h Global data_breach Multiple sectors HIGH 3h
Vulnerabilities

CVE-2026-22601

High
OpenProject Command Injection via Sendmail Configuration (CVE-2026-22601)
CWE-77 — Weakness Type
Published: Jan 10, 2026  ·  Modified: Feb 28, 2026  ·  Source: NVD
CVSS v3
7.2
🔗 NVD Official
📄 Description (English)

OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configuring sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.

🤖 AI Executive Summary

OpenProject versions 16.6.1 and below contain a critical command injection vulnerability (CWE-77) allowing authenticated administrators to execute arbitrary system commands by manipulating the sendmail binary path configuration and triggering a test email. The vulnerability has been patched in version 16.6.2.

📄 Description (Arabic)

تؤثر هذه الثغرة الأمنية على نظام إدارة المشاريع مفتوح المصدر OpenProject في الإصدارات 16.6.1 وما قبلها. يمكن للمسؤول المصادق عليه استغلال آلية إعدادات البريد الإلكتروني عبر تعديل مسار ملف sendmail الثنائي وإدخال أوامر ضارة يتم تنفيذها عند إرسال بريد اختباري. تصنف الثغرة ضمن CWE-77 (حقن الأوامر) وتحمل درجة خطورة 7.2 على مقياس CVSS. يتطلب الاستغلال صلاحيات إدارية مما يقلل من احتمالية الاستغلال الخارجي لكنه يشكل خطراً كبيراً في حالات اختراق حسابات المسؤولين أو التهديدات الداخلية.

🤖 ملخص تنفيذي (AI)

تحتوي إصدارات OpenProject 16.6.1 وما دون على ثغرة حقن أوامر حرجة تسمح للمسؤولين المصادق عليهم بتنفيذ أوامر نظام عشوائية من خلال التلاعب بمسار sendmail وإرسال بريد اختباري. تم إصلاح الثغرة في الإصدار 16.6.2.

🤖 AI Intelligence Analysis Analyzed: Feb 28, 2026 08:12
🇸🇦 Saudi Arabia Impact Assessment
Saudi organizations using OpenProject for project management face significant risk of complete system compromise if administrator accounts are compromised. This is particularly critical for government entities and enterprises managing sensitive projects under NCA and SAMA oversight, as attackers could gain full server control, exfiltrate confidential project data, or pivot to connected systems.
🏢 Affected Saudi Sectors
القطاع الحكومي القطاع المالي والمصرفي قطاع الاتصالات وتقنية المعلومات قطاع الطاقة والمرافق قطاع التعليم قطاع الرعاية الصحية
⚖️ Saudi Risk Score (AI)
8.0
/ 10.0
🔧 Remediation Steps (English)
1. Immediately upgrade all OpenProject installations to version 16.6.2 or later to patch the command injection vulnerability
2. Conduct security audit of all administrator accounts, enforce MFA, review recent email configuration changes and system logs for suspicious sendmail path modifications or test email activities
3. Implement principle of least privilege by restricting administrator access, deploy application-level controls to validate and sanitize sendmail binary paths, and isolate OpenProject servers using network segmentation
🔧 خطوات المعالجة (العربية)
1. الترقية الفورية لجميع تثبيتات OpenProject إلى الإصدار 16.6.2 أو أحدث لإصلاح ثغرة حقن الأوامر
2. إجراء مراجعة أمنية شاملة لجميع حسابات المسؤولين وتفعيل المصادقة متعددة العوامل ومراجعة سجلات التغييرات الأخيرة في إعدادات البريد الإلكتروني والأنشطة المشبوهة المتعلقة بتعديل مسار sendmail
3. تطبيق مبدأ الصلاحيات الأقل امتيازاً بتقييد الوصول الإداري ونشر ضوابط على مستوى التطبيق للتحقق من مسارات sendmail وعزل خوادم OpenProject باستخدام تجزئة الشبكة
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC-1-2 (Vulnerability Management) ECC-3-1 (Access Control) ECC-4-1 (System Hardening) ECC-5-2 (Security Monitoring)
🔵 SAMA CSF
CCC-1.1.1 (Cybersecurity Policy) CCC-3.1.1 (Vulnerability Assessment) CCC-4.2.1 (Privileged Access Management) CCC-6.1.1 (Security Monitoring)
🟡 ISO 27001:2022
A.12.6.1 (Technical Vulnerability Management) A.9.2.3 (Management of Privileged Access Rights) A.14.2.5 (Secure System Engineering Principles)
📦 Affected Products / CPE 1 entries
openproject:openproject
📊 CVSS Score
7.2
/ 10.0 — High
📊 CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack VectorN — None / Network
Attack ComplexityL — Low / Local
Privileges RequiredH — High
User InteractionN — None / Network
ScopeU — Unchanged
ConfidentialityH — High
IntegrityH — High
AvailabilityH — High
📋 Quick Facts
Severity High
CVSS Score7.2
CWECWE-77
EPSS0.08%
Exploit No
Patch ✓ Yes
Published 2026-01-10
Source Feed nvd
Views 1
🇸🇦 Saudi Risk Score
8.0
/ 10.0 — Saudi Risk
Priority: HIGH
🏷️ Tags
CWE-77
Share this CVE
📣 Found this valuable?
Share it with your cybersecurity network
in LinkedIn 𝕏 X / Twitter 💬 WhatsApp ✈ Telegram
🍪 Privacy Preferences
CISO Consulting — Compliant with Saudi Personal Data Protection Law (PDPL)
We use cookies and similar technologies to provide the best experience on our platform. You can choose which types you accept.
🔒
Essential Always On
Required for the website to function properly. Cannot be disabled.
📋 Sessions, CSRF tokens, authentication, language preferences
📊
Analytics
Help us understand how visitors use the site and improve performance.
📋 Page views, session duration, traffic sources, performance metrics
⚙️
Functional
Enable enhanced features like content personalization and preferences.
📋 Dark/light theme, font size, custom dashboards, saved filters
📣
Marketing
Used to deliver content and ads relevant to your interests.
📋 Campaign tracking, retargeting, social media analytics
Privacy Policy →
CISO AI Assistant
Ask anything · Documents · Support
🔐

Introduce Yourself

Enter your details to access the full assistant

Your info is private and never shared
💬
CyberAssist
Online · responds in seconds
5 / 5
🔐 Verify Your Identity

Enter your email to receive a verification code before submitting a support request.

Enter to send · / for commands 0 / 2000
CISO AI · Powered by Anthropic Claude
✦ Quick Survey Help Us Improve CISO Consulting Your feedback shapes the future of our platform — takes less than 2 minutes.
⚠ Please answer this question to continue

How would you rate your overall experience with our platform?

Rate from 1 (poor) to 5 (excellent)

🎉
Thank you!
Your response has been recorded.