CVE-2026-6885 affects Borg SPM 2007 developed by BorG Technology Corporation, which had sales ended in 2008. The vulnerability allows arbitrary file upload by unauthenticated remote attackers. Attackers can upload and execute web shell backdoors on the server. This enables arbitrary code execution with remote access capabilities. The product is legacy software that is no longer sold or supported. Despite being end-of-life, systems may still be running this vulnerable software in production environments.