Security readout for executives and security teams
Plain-English summary
CVE-2026-27947 is a critical authenticated remote code execution flaw in Group-Office. A logged-in attacker can abuse TNEF email attachment handling to make the server run arbitrary commands. Organizations using affected Group-Office versions should prioritize upgrading because successful exploitation can compromise confidentiality, integrity, and availability.
Executive priority
Treat as urgent for any deployed Group-Office environment. Although authentication is required and active exploitation is not confirmed in the provided sources, the impact is full server compromise. Upgrade fixed versions promptly, starting with internet-facing systems.
Technical view
Affected Group-Office versions extract attacker-controlled files from winmail.dat during TNEF attachment processing, then invoke zip with a shell wildcard. Malicious filenames can be interpreted as zip options, enabling arbitrary command execution. The issue is tracked as CWE-434 and CWE-88 and is fixed in 26.0.9, 25.0.87, and 6.8.154.
Likely exposure
Exposure is limited to Group-Office deployments running vulnerable versions: 26.0.0 through before 26.0.9, 25.0.0 through before 25.0.87, and versions before 6.8.154. The CVSS vector indicates network access, low complexity, low privileges, and no user interaction.
Exploitation context
The vulnerability requires authentication but no user interaction. Public sources provided do not state active exploitation, and the CVE is not marked as CISA KEV in the source bundle. Risk remains high because exploitation can lead to server-side command execution after login.
Researcher notes
The root issue is unsafe handling of attacker-controlled filenames during TNEF extraction combined with wildcard-based zip invocation. Sources do not provide exploit indicators, proof-of-concept status, or compensating controls beyond fixed versions. Validate exposure by version and deployment reachability rather than assuming exploitation.
Mitigation direction
- Upgrade Group-Office to 26.0.9, 25.0.87, 6.8.154, or later fixed releases.
- Prioritize externally reachable or internet-accessible Group-Office instances.
- Review vendor advisory for any additional hardening or operational guidance.
- Restrict access to Group-Office where feasible until fixed.
Validation and detection
- Inventory all Group-Office instances and record exact installed versions.
- Confirm no deployment runs versions below 26.0.9, 25.0.87, or 6.8.154.
- Check whether Group-Office is reachable from untrusted networks.
- Review authentication logs for unusual account activity around email attachment processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-88: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27947 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Intermesh/groupoffice/security/advisories/GHSA-2rwh-9qp7-f92xCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.