CVE-2021-26607: Tobesoft Nexacro

Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days.

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.

Affected products

• Tobesoft Nexacro: up to and including 17.1.3.301

Published 2021-10-26. Last modified 2026-06-17.