Common Weakness Enumeration
CWE-306
AllowedMissing Authentication for Critical Function
Abstraction: Base · Status: Draft
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
4553 vulnerabilities reference this CWE, most recent first.
CVE-2026-76439 (GCVE-0-2026-76439)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:17 – Updated: 2026-09-18 14:46
VLAI
EPSS
VEX
Title
Cisco Identity Services Engine Event Injection Vulnerability
Summary
A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline.
This vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:39 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Identity Services Engine Software |
Affected:
3.1.0
Affected: 3.1.0 p1 Affected: 3.1.0 p3 Affected: 3.1.0 p2 Affected: 3.2.0 Affected: 3.1.0 p4 Affected: 3.1.0 p5 Affected: 3.2.0 p1 Affected: 3.1.0 p6 Affected: 3.2.0 p2 Affected: 3.1.0 p7 Affected: 3.3.0 Affected: 3.2.0 p3 Affected: 3.2.0 p4 Affected: 3.1.0 p8 Affected: 3.2.0 p5 Affected: 3.2.0 p6 Affected: 3.1.0 p9 Affected: 3.3 Patch 2 Affected: 3.3 Patch 1 Affected: 3.3 Patch 3 Affected: 3.4.0 Affected: 3.2.0 p7 Affected: 3.3 Patch 4 Affected: 3.4 Patch 1 Affected: 3.1.0 p10 Affected: 3.3 Patch 5 Affected: 3.3 Patch 6 Affected: 3.4 Patch 2 Affected: 3.3 Patch 7 Affected: 3.4 Patch 3 Affected: 3.5.0 Affected: 3.4 Patch 4 Affected: 3.3 Patch 8 Affected: 3.2 Patch 8 Affected: 3.5 Patch 1 Affected: 3.3 Patch 9 Affected: 3.2 Patch 9 Affected: 3.4 Patch 5 Affected: 3.5 Patch 3 Affected: 3.5 Patch 2 Affected: 3.3 Patch 10 Affected: 3.3 Patch 11 Affected: 3.4 Patch 6 Affected: 3.2 Patch 10 Affected: 3.1.0 p72 Affected: 3.1.0 p11 |
|
| Cisco | Cisco ISE Passive Identity Connector |
Affected:
3.2.0
Affected: 3.1.0 Affected: 3.3.0 Affected: 3.4.0 Affected: 3.5.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:39:40.548835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:46:10.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Identity Services Engine Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.0 p1"
},
{
"status": "affected",
"version": "3.1.0 p3"
},
{
"status": "affected",
"version": "3.1.0 p2"
},
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.1.0 p4"
},
{
"status": "affected",
"version": "3.1.0 p5"
},
{
"status": "affected",
"version": "3.2.0 p1"
},
{
"status": "affected",
"version": "3.1.0 p6"
},
{
"status": "affected",
"version": "3.2.0 p2"
},
{
"status": "affected",
"version": "3.1.0 p7"
},
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.2.0 p3"
},
{
"status": "affected",
"version": "3.2.0 p4"
},
{
"status": "affected",
"version": "3.1.0 p8"
},
{
"status": "affected",
"version": "3.2.0 p5"
},
{
"status": "affected",
"version": "3.2.0 p6"
},
{
"status": "affected",
"version": "3.1.0 p9"
},
{
"status": "affected",
"version": "3.3 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 3"
},
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.2.0 p7"
},
{
"status": "affected",
"version": "3.3 Patch 4"
},
{
"status": "affected",
"version": "3.4 Patch 1"
},
{
"status": "affected",
"version": "3.1.0 p10"
},
{
"status": "affected",
"version": "3.3 Patch 5"
},
{
"status": "affected",
"version": "3.3 Patch 6"
},
{
"status": "affected",
"version": "3.4 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 7"
},
{
"status": "affected",
"version": "3.4 Patch 3"
},
{
"status": "affected",
"version": "3.5.0"
},
{
"status": "affected",
"version": "3.4 Patch 4"
},
{
"status": "affected",
"version": "3.3 Patch 8"
},
{
"status": "affected",
"version": "3.2 Patch 8"
},
{
"status": "affected",
"version": "3.5 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 9"
},
{
"status": "affected",
"version": "3.2 Patch 9"
},
{
"status": "affected",
"version": "3.4 Patch 5"
},
{
"status": "affected",
"version": "3.5 Patch 3"
},
{
"status": "affected",
"version": "3.5 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 10"
},
{
"status": "affected",
"version": "3.3 Patch 11"
},
{
"status": "affected",
"version": "3.4 Patch 6"
},
{
"status": "affected",
"version": "3.2 Patch 10"
},
{
"status": "affected",
"version": "3.1.0 p72"
},
{
"status": "affected",
"version": "3.1.0 p11"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco ISE Passive Identity Connector",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline.\r\n\r\nThis vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is aware that a public announcement is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:17:47.616Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ise-multiauth-bypass-sgD2HbL4",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4"
}
],
"source": {
"advisory": "cisco-sa-ise-multiauth-bypass-sgD2HbL4",
"defects": [
"CSCwu73771"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Identity Services Engine Event Injection Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76439",
"datePublished": "2026-09-16T20:17:47.616Z",
"dateReserved": "2026-08-19T12:02:03.635Z",
"dateUpdated": "2026-09-18T14:46:10.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76355 (GCVE-0-2026-76355)
Vulnerability from cvelistv5 – Published: 2026-08-19 21:34 – Updated: 2026-08-26 15:20
VLAI
EPSS
VEX
Title
Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise
Summary
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls. For more information see System architecture of the Edge Processor solution (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/how-the-edge-processor-solution-works/system-architecture-of-the-edge-processor-solution) in the Splunk documentation.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:17 UTC
CWE
- CWE-306 - The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
10.4 , < 10.4.2
(custom)
|
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T15:17:50.530633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T15:20:53.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "10.4.2",
"status": "affected",
"version": "10.4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Gabriel Nitu, Splunk"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls. For more information see [System architecture of the Edge Processor solution](https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/how-the-edge-processor-solution-works/system-architecture-of-the-edge-processor-solution) in the Splunk documentation."
}
],
"value": "In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls. For more information see System architecture of the Edge Processor solution (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/how-the-edge-processor-solution-works/system-architecture-of-the-edge-processor-solution) in the Splunk documentation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T21:34:47.950Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0801"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher."
}
],
"source": {
"advisory": "SVD-2026-0801"
},
"title": "Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise",
"workarounds": [
{
"lang": "en",
"value": "Turn off Edge Processor by setting edge_processor_enabled = false in the server.conf configuration file if you do not use Edge Processor. For more information see [Sidecar configuration settings](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76355",
"datePublished": "2026-08-19T21:34:47.950Z",
"dateReserved": "2026-08-19T12:02:03.628Z",
"dateUpdated": "2026-08-26T15:20:53.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76157 (GCVE-0-2026-76157)
Vulnerability from cvelistv5 – Published: 2026-08-21 01:47 – Updated: 2026-08-21 13:08
VLAI
EPSS
VEX
Title
Datiphy Data Management Center - Missing Authentication for Critical Function
Summary
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 13:07 UTC
CWE
- CWE-306 - Missing authentication for critical function
References
1 reference
| URL | Tags |
|---|---|
| https://zuso.ai/advisory | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datiphy Inc. | Data Management Center |
Affected:
v8.3.0 , ≤ v8.5.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76157",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T13:07:58.214740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T13:08:10.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Data Management Center",
"vendor": "Datiphy Inc.",
"versions": [
{
"lessThanOrEqual": "v8.5.1",
"status": "affected",
"version": "v8.3.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server\u0027s configured upload directory."
}
],
"value": "Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server\u0027s configured upload directory."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T01:47:44.338Z",
"orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
"shortName": "ZUSO ART"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://zuso.ai/advisory"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Datiphy Data Management Center - Missing Authentication for Critical Function",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
"assignerShortName": "ZUSO ART",
"cveId": "CVE-2026-76157",
"datePublished": "2026-08-21T01:47:44.338Z",
"dateReserved": "2026-08-19T08:03:53.871Z",
"dateUpdated": "2026-08-21T13:08:10.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76142 (GCVE-0-2026-76142)
Vulnerability from cvelistv5 – Published: 2026-10-01 04:53 – Updated: 2026-10-01 15:58
VLAI
EPSS
VEX
Title
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
Summary
Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:58 UTC
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Genians, Inc | Genian NAC 5.0.75 LTS Release |
Affected:
135823 , < 148667
(custom)
|
|
| Genians, Inc | Genian NAC 5.0.85 Release Stable |
Affected:
147181 , < 148666
(custom)
|
|
| Genians, Inc | Genian NAC 5.0.86 Release |
Affected:
148018 , < 148665
(custom)
|
|
| Genians, Inc | Genian ZTNA 6.0.35 LTS Release |
Affected:
135814 , < 148672
(custom)
|
|
| Genians, Inc | Genian ZTNA 6.0.45 Release Stable |
Affected:
147169 , < 148671
(custom)
|
|
| Genians, Inc | Genian ZTNA 6.0.46 Release |
Affected:
148028 , < 148670
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76142",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:58:10.619392Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:58:20.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Genian NAC 5.0.75 LTS Release",
"vendor": "Genians, Inc",
"versions": [
{
"lessThan": "148667",
"status": "affected",
"version": "135823",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Genian NAC 5.0.85 Release Stable",
"vendor": "Genians, Inc",
"versions": [
{
"lessThan": "148666",
"status": "affected",
"version": "147181",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Genian NAC 5.0.86 Release",
"vendor": "Genians, Inc",
"versions": [
{
"lessThan": "148665",
"status": "affected",
"version": "148018",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Genian ZTNA 6.0.35 LTS Release",
"vendor": "Genians, Inc",
"versions": [
{
"lessThan": "148672",
"status": "affected",
"version": "135814",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Genian ZTNA 6.0.45 Release Stable",
"vendor": "Genians, Inc",
"versions": [
{
"lessThan": "148671",
"status": "affected",
"version": "147169",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Genian ZTNA 6.0.46 Release",
"vendor": "Genians, Inc",
"versions": [
{
"lessThan": "148670",
"status": "affected",
"version": "148028",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "segyeong"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions\u003c/p\u003e"
}
],
"value": "Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T04:53:35.730Z",
"orgId": "cdd7a122-0fae-4202-8d86-14efbacc2863",
"shortName": "krcert"
},
"references": [
{
"url": "https://docs.genians.com/release/ko/advisories/GN-SA-2026-002.html"
},
{
"url": "https://github.com/genians/security-research/security/advisories/GHSA-qf3p-2jpg-3h95"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGenian NAC 5.0.75 LTS Release: update to Revision 148667 or later.\u003c/p\u003e\u003cp\u003eGenian NAC 5.0.85 Release Stable: update to Revision 148666 or later.\u003c/p\u003e\u003cp\u003eGenian NAC 5.0.86 Release: update to Revision 148665 or later.\u003c/p\u003e\u003cp\u003eGenian ZTNA 6.0.35 LTS Release: update to Revision 148672 or later.\u003c/p\u003e\u003cp\u003eGenian ZTNA 6.0.45 Release Stable: update to Revision 148671 or later.\u003c/p\u003e\u003cp\u003eGenian ZTNA 6.0.46 Release: update to Revision 148670 or later.\u003c/p\u003e"
}
],
"value": "Genian NAC 5.0.75 LTS Release: update to Revision 148667 or later.\n\n\n\nGenian NAC 5.0.85 Release Stable: update to Revision 148666 or later.\n\n\n\nGenian NAC 5.0.86 Release: update to Revision 148665 or later.\n\n\n\nGenian ZTNA 6.0.35 LTS Release: update to Revision 148672 or later.\n\n\n\nGenian ZTNA 6.0.45 Release Stable: update to Revision 148671 or later.\n\n\n\nGenian ZTNA 6.0.46 Release: update to Revision 148670 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cdd7a122-0fae-4202-8d86-14efbacc2863",
"assignerShortName": "krcert",
"cveId": "CVE-2026-76142",
"datePublished": "2026-10-01T04:53:35.730Z",
"dateReserved": "2026-08-19T04:13:00.870Z",
"dateUpdated": "2026-10-01T15:58:20.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76137 (GCVE-0-2026-76137)
Vulnerability from cvelistv5 – Published: 2026-08-21 02:02 – Updated: 2026-08-21 12:54
VLAI
EPSS
VEX
Summary
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 12:53 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yamaha Corporation | VOCALOID6 |
Affected:
0 , ≤ 6.13.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76137",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:53:44.462769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:54:10.665Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VOCALOID6",
"vendor": "Yamaha Corporation",
"versions": [
{
"lessThanOrEqual": "6.13.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing authentication for critical function",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T02:02:54.389Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.vocaloid.com/en/support/download/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU90210212/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-76137",
"datePublished": "2026-08-21T02:02:54.389Z",
"dateReserved": "2026-08-20T02:19:38.781Z",
"dateUpdated": "2026-08-21T12:54:10.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75969 (GCVE-0-2026-75969)
Vulnerability from cvelistv5 – Published: 2026-09-30 16:27 – Updated: 2026-09-30 20:01
VLAI
EPSS
VEX
Title
PTZOptics Missing Authentication in Firmware Upload
Summary
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
* Move 4K 12X before: 0.0.98
* Move 4K 20X before: 0.1.33
* Move 4K 30X before: 2.1.17
* Link 4K 12X before: 0.0.99
* Link 4K 20X before: 0.1.37
* Link 4K 30X before: 2.1.18
* Move SE 12X before: 9.1.66
* Move SE 20X before: 9.1.44
* Move SE 30X before: 9.1.46
* Studio 4K 12X before: 8.3.32
* Studio 4K 20X before: 8.3.32
* Studio SE 12X before: 8.3.32
* Studio SE 20X before: 8.3.32
* All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
* Upgrade Tool - All versions
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 18:30 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.havsys.com/ |
Impacted products
24 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T18:30:11.739848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:01:02.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.98",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.1.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.99",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.66",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.44",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.46",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio SE 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio SE 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-USB-GY-G2, PT12X-USB-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-USB-GY-G2, PT20X-USB-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PTVL-ZCAM, PTVL-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-ZCAM, PT12X-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-ZCAM, PT20X-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Studio Pro",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "Upgrade Tool",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Haverford Systems Inc. \u0026 PTZOptics would like to thank Jaroslav Svoboda of CESNET for responsibly reporting this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.\n\u003cbr\u003e\n\u003cbr\u003eThis vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eMove 4K 12X before: 0.0.98\u003c/li\u003e\u003cli\u003eMove 4K 20X before: 0.1.33\u003c/li\u003e\u003cli\u003eMove 4K 30X before: 2.1.17\u003c/li\u003e\u003cli\u003eLink 4K 12X before: 0.0.99\u003c/li\u003e\u003cli\u003eLink 4K 20X before: 0.1.37\u003c/li\u003e\u003cli\u003eLink 4K 30X before: 2.1.18\u003c/li\u003e\u003cli\u003eMove SE 12X before: 9.1.66\u003c/li\u003e\u003cli\u003eMove SE 20X before: 9.1.44\u003c/li\u003e\u003cli\u003eMove SE 30X before: 9.1.46\u003c/li\u003e\u003cli\u003eStudio 4K 12X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio 4K 20X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio SE 12X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio SE 20X before: 8.3.32\u003c/li\u003e\u003cli\u003eAll Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions\u003c/li\u003e\u003cli\u003eUpgrade Tool - All versions\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.\n\n\n\nThis vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:\n\n\n\n\n\n * Move 4K 12X before: 0.0.98\n * Move 4K 20X before: 0.1.33\n * Move 4K 30X before: 2.1.17\n * Link 4K 12X before: 0.0.99\n * Link 4K 20X before: 0.1.37\n * Link 4K 30X before: 2.1.18\n * Move SE 12X before: 9.1.66\n * Move SE 20X before: 9.1.44\n * Move SE 30X before: 9.1.46\n * Studio 4K 12X before: 8.3.32\n * Studio 4K 20X before: 8.3.32\n * Studio SE 12X before: 8.3.32\n * Studio SE 20X before: 8.3.32\n * All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions\n * Upgrade Tool - All versions"
}
],
"impacts": [
{
"capecId": "CAPEC-638",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-638 Altered Component Firmware"
}
]
},
{
"capecId": "CAPEC-669",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-669 Alteration of a Software Update"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/R:U/V:C/RE:L/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:27:51.490Z",
"orgId": "16cac6a8-cc1e-4741-89aa-6b97e2437706",
"shortName": "hsi"
},
"references": [
{
"url": "https://psirt.havsys.com/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eProduct\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eRemediation\u003c/b\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.0.98.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.1.33.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 30X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 2.1.17.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.0.99.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.1.37.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 30X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 2.1.18.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 12X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.66.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 20X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.44.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 30X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.46.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio SE 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio SE 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "ProductRemediationMove 4K 12XUpdate to Firmware 0.0.98.Move 4K 20XUpdate to Firmware 0.1.33.Move 4K 30XUpdate to Firmware 2.1.17.Link 4K 12XUpdate to Firmware 0.0.99.Link 4K 20XUpdate to Firmware 0.1.37.Link 4K 30XUpdate to Firmware 2.1.18.Move SE 12X\u00a0Update to Firmware 9.1.66.Move SE 20X\u00a0Update to Firmware 9.1.44.Move SE 30X\u00a0Update to Firmware 9.1.46.Studio 4K 12XUpdate to Firmware 8.3.32Studio 4K 20XUpdate to Firmware 8.3.32.Studio SE 12XUpdate to Firmware 8.3.32.Studio SE 20XUpdate to Firmware 8.3.32"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PTZOptics Missing Authentication in Firmware Upload",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eDisable network services until the firmware can be updated.\u003c/li\u003e\u003cli\u003eRestrict access to the camera to a trusted management VLAN.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Disable network services until the firmware can be updated.\n * Restrict access to the camera to a trusted management VLAN."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "16cac6a8-cc1e-4741-89aa-6b97e2437706",
"assignerShortName": "hsi",
"cveId": "CVE-2026-75969",
"datePublished": "2026-09-30T16:27:51.490Z",
"dateReserved": "2026-08-18T17:26:08.229Z",
"dateUpdated": "2026-09-30T20:01:02.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75919 (GCVE-0-2026-75919)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:01 – Updated: 2026-08-19 15:30
VLAI
EPSS
VEX
Title
phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
Summary
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 15:30 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/thorsten/phpMyFAQ/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/phpmyfaq-bef… | third-party-advisory |
Impacted products
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75919",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T15:30:05.657562Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T15:30:39.107Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f96w-7fx2-79c8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "phpMyFAQ",
"vendor": "thorsten",
"versions": [
{
"lessThan": "4.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.1.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kevinnivekkevin"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:01:52.508Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-f96w-7fx2-79c8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f96w-7fx2-79c8"
},
{
"name": "VulnCheck Advisory: phpMyFAQ before 4.1.7 Authentication Bypass via Setup API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-setup-api"
}
],
"title": "phpMyFAQ before 4.1.7 Authentication Bypass via Setup API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-75919",
"datePublished": "2026-08-19T14:01:52.508Z",
"dateReserved": "2026-08-18T15:05:54.226Z",
"dateUpdated": "2026-08-19T15:30:39.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75854 (GCVE-0-2026-75854)
Vulnerability from cvelistv5 – Published: 2026-08-18 11:19 – Updated: 2026-08-18 14:18
VLAI
EPSS
VEX
Title
ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
Summary
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:17 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ArcadeData/arcadedb/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/arcadedb-red… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ArcadeData | arcadedb |
Affected:
0 , < 26.8.1
(semver)
Unaffected: 26.8.1 (semver) |
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75854",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:17:56.551792Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:18:02.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.arcadedb/arcadedb-redis",
"product": "arcadedb",
"vendor": "ArcadeData",
"versions": [
{
"lessThan": "26.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "26.8.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xancyber"
},
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T11:19:57.266Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m46c-jh3x-xwrp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp"
},
{
"name": "VulnCheck Advisory: ArcadeDB Redis Wire-Protocol Plugin Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication"
}
],
"title": "ArcadeDB Redis Wire-Protocol Plugin Missing Authentication",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-75854",
"datePublished": "2026-08-18T11:19:57.266Z",
"dateReserved": "2026-08-18T11:03:08.682Z",
"dateUpdated": "2026-08-18T14:18:02.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75852 (GCVE-0-2026-75852)
Vulnerability from cvelistv5 – Published: 2026-08-18 11:19 – Updated: 2026-08-18 13:35
VLAI
EPSS
VEX
Title
ArcadeDB MongoDB wire protocol authentication bypass cross-database
Summary
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 12:56 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ArcadeData/arcadedb/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/arcadedb-mon… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ArcadeData | arcadedb |
Affected:
0 , < 26.8.1
(semver)
Unaffected: 26.8.1 (semver) |
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T12:56:22.405427Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:35:48.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.arcadedb/arcadedb-mongodbw",
"product": "arcadedb",
"vendor": "ArcadeData",
"versions": [
{
"lessThan": "26.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "26.8.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
},
{
"lang": "en",
"type": "reporter",
"value": "chow8386"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T11:19:55.908Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fq9c-x968-g278)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-fq9c-x968-g278"
},
{
"name": "VulnCheck Advisory: ArcadeDB MongoDB wire protocol authentication bypass cross-database",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/arcadedb-mongodb-wire-protocol-authentication-bypass-cross-database"
}
],
"title": "ArcadeDB MongoDB wire protocol authentication bypass cross-database",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-75852",
"datePublished": "2026-08-18T11:19:55.908Z",
"dateReserved": "2026-08-18T11:03:08.681Z",
"dateUpdated": "2026-08-18T13:35:48.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75825 (GCVE-0-2026-75825)
Vulnerability from cvelistv5 – Published: 2026-09-23 12:35 – Updated: 2026-09-24 03:55
VLAI
EPSS
VEX
Title
Authentication Bypass vulnerability
Summary
ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 00:00 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zohocorp | ManageEngine OpManager |
Affected:
0 , < 12.8.711
(custom)
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T03:55:19.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ManageEngine OpManager",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "12.8.711",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.8.711",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.\u003cbr\u003e"
}
],
"value": "ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T12:35:00.864Z",
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"shortName": "Zohocorp"
},
"references": [
{
"url": "https://www.manageengine.com/itom/advisory/cve-2026-75825.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication Bypass vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"assignerShortName": "Zohocorp",
"cveId": "CVE-2026-75825",
"datePublished": "2026-09-23T12:35:00.864Z",
"dateReserved": "2026-08-18T10:50:37.064Z",
"dateUpdated": "2026-09-24T03:55:19.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
- Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
- In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
Architecture and Design
- Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
- In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
Implementation
System Configuration
Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
CAPEC-12: Choosing Message Identifier
This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.
CAPEC-166: Force the System to Reset Values
An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.
CAPEC-216: Communication Channel Manipulation
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.
CAPEC-36: Using Unpublished Interfaces or Functionality
An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.