CVE-2026-74237

Name of the Vulnerable Software and Affected Versions GFI Exinda AI versions prior to 7.6.5 GFI ClearView versions prior to 7.6.5

Description An argument injection issue exists in the Tools Iperf Client functionality. The web tools cmd() function constructs an iperf command using the server and options parameters without proper sanitization, allowing the injection of arbitrary iperf flags. An authenticated attacker with unprivileged access can use the -F flag to read arbitrary files from the system and transmit the contents to an external server.

Recommendations Update GFI Exinda AI to version 7.6.5 or later. Update GFI ClearView to version 7.6.5 or later.