External risk intelligence

EagleCloud Aquila Pigeon MFA Code Injection

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-104383

The vulnerability affects a Multi-Factor Authentication (MFA) service. MFA services are inherently designed to be public-facing or externally reachable components to facilitate user authentication for remote access, identity verification, and security gateways, making them a common internet-facing service.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the Pigeon MFA service within EagleCloud Aquila allows authenticated attackers to run unauthorized code through code injection. This could potentially impact systems relying on this authentication service.

Code injection vulnerability in MFA service.
Affects critical authentication infrastructure.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers with existing access to the Pigeon MFA service can inject malicious code to run commands on the system. This is possible because the service improperly controls the generation of code, allowing remote attackers to execute arbitrary code when they can provide specially crafted input. The risk is that an attacker could gain significant control over the affected platform.

Authenticated remote access is required.
Code injection into the MFA service triggers the vulnerability.
Arbitrary code execution leading to system compromise.

Live Threat

Current exploitation, exposure, and threat context

Authenticated remote attackers could inject code into the Pigeon MFA service, potentially allowing arbitrary code execution. This could affect the integrity and availability of the MFA service, and by extension, any systems or data that rely on it for authentication.

MFA service integrity and availability are at risk.
Code injection may occur via authenticated access.
Compromised authentication could impact protected systems.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Pigeon MFA service, utilized by on-premises EagleCloud Aquila deployments, presents a critical risk due to potential code injection vulnerabilities. Responsibility for addressing this likely falls to the platform or infrastructure teams managing the EagleCloud environment, in coordination with the security or network team responsible for securing external-facing services. The initial priority is to identify all instances of the affected service, confirm its accessibility and business criticality, and then engage the relevant platform owners to plan remediation.

Platform/Infrastructure teams own remediation.
Verify service reachability and criticality.
Plan vendor engagement and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Pigeon MFA service in EagleCloud Aquila?

Pigeon is a component within the EagleCloud Aquila platform that manages multi-factor authentication. Organizations use this on-premises service to verify user identities and secure access to their private networks and internal resources, serving as a gatekeeper for authentication requests.

What does CWE-94 mean for CVE-2026-104383?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). In plain terms, the system fails to properly filter or sanitize user input before processing it. Because of this, an attacker can supply specially crafted data that the service mistakenly treats as executable commands, leading to unauthorized code execution.

How is this code injection triggered?

An attacker must be able to authenticate to the Pigeon MFA service to trigger this vulnerability. It does not occur through unauthenticated public probes; the attacker needs valid credentials to reach the vulnerable interface where they can submit the malicious input that causes the code injection.

Is my Pigeon MFA instance at risk?

According to Halo Surface Signal, MFA services are typically designed to be internet-facing to handle remote authentication. If your Pigeon deployment is reachable from the internet, it is a higher priority for review because external attackers with valid access can reach the vulnerable component.

How should I respond to this vulnerability?

Start by identifying all instances of EagleCloud Aquila running the Pigeon MFA service in your environment. Confirm which instances are accessible externally and assess their business role. Once mapped, coordinate with your infrastructure and security teams to apply vendor-supplied updates or follow their recommended guidance for remediation.

References

github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/M…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.