Key points
- CVE-2026-63146 carries a CVSS score of 9.3, rated Critical.
- The vulnerability affects Omnispace Agora Project versions prior to 26.10.0.
- Attackers can inject PHP code into config.inc.php during installation.
Omnispace Agora Project contains a severe security flaw that allows unauthenticated remote code execution. According to the National Vulnerability Database record for CVE-2026-63146, this issue affects all versions of the software released before version 26.10.0. Security teams managing these environments should treat this as an immediate risk to system integrity.
The vulnerability stems from how the application handles configuration data during the installation process. Attackers can exploit an SQL injection issue to re-trigger the installer. This action allows them to write unescaped, attacker-controlled values directly into the config.inc.php file. The flaw is classified as CWE-94, indicating improper control of generation of code.
Technical Mechanics of the Exploit
The exploit chain relies on specific database configuration settings. The SQL injection is enabled because PDO::ATTR_EMULATE_PREPARES supports stacked queries in this context. Attackers use this capability to manipulate the installation routines. Specifically, they target the File::updateConfigFile() and DbInstall::dbControl() functions. These functions fail to properly escape input, allowing arbitrary PHP code to be stored in the configuration file.
Scope of Affected Systems
Only Omnispace Agora Project installations running versions earlier than 26.10.0 are vulnerable. Organizations using this specific software stack must verify their current version immediately. The National Vulnerability Database rates the severity of CVE-2026-63146 as Critical with a CVSS score of 9.3. This high score reflects the ease of exploitation and the severe impact of remote code execution on the underlying host system.
Next steps
Administrators must inventory their environments to identify any instances of Omnispace Agora Project. They should check the version number against the affected range. If a system is running a version before 26.10.0, it is exposed to this threat. Teams should monitor for unauthorized access to installation endpoints. Isolating affected systems from the network is a prudent measure while assessing exposure.
Signals worth monitoring
Teams usually detect this activity by reviewing web server access logs for unusual requests to installation scripts. Look for POST requests containing SQL syntax or PHP code payloads directed at setup endpoints. Check file integrity monitoring alerts for unexpected modifications to configuration files like config.inc.php. Inspect database logs for stacked query attempts or unusual command execution patterns. Verify that no new processes are spawned by the web server user.
What to do and how to stay safe: Omnispace
- Identify all servers running Omnispace Agora Project and confirm their version numbers.
- Restrict network access to installation endpoints to prevent unauthorized triggers.
- Monitor web server logs for suspicious payloads targeting configuration files.
- Prepare to isolate affected systems if exploitation indicators are detected.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Agora Project vulnerability?
The vulnerability is tracked as CVE-2026-63146.
Which versions of Omnispace Agora are affected?
All versions prior to 26.10.0 are affected by this flaw.
What is the CVSS score for this issue?
The National Vulnerability Database assigns a CVSS score of 9.3.
