GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0340

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
Title
SEC Consult SA-20260615-0 :: Multiple Critical Vulnerabilities in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260615-0 > ======================================================================= title: Multiple Critical Vulnerabilities product: Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) vulnerable version: AssemblyVersion 6.15.8328.28014 fixed version: No information provided by vendor CVE number: CVE-2026-34023, CVE-2026-34024, CVE-2026-34025,                     CVE-2026-34026, CVE-2026-34027, CVE-2026-34028,                     CVE-2026-34029, CVE-2026-34030              impact: critical homepage:https://wertheim-safes.com/safe-deposit-box-management/               found: 2023-04-03 by: Christian Hager (Office Vienna) Gorazd Jank (Office Vienna) Philipp Espernberger (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "On September 1, 1852, Franz Wertheim and 85 employees began to build "fireproof safes". Then as now, Wertheim has been successfully involved in production of safes and banking facilities, nationally and internationally. To secure the market position and develop new business areas, Wertheim has continuously adapted its product range over the years as well as expanded its assortment of offerings. Today, the Wertheim Group of companies also produces bank and object furnishings in our own joinery in Uttendorf, and Commissioned Work has developed into an essential business area for the group. The diversity of state-of-the-art technologies characterizes the flexibility and technical know-how of this division." Source:https://wertheim.at/en/company/ (2023) Business recommendation: ------------------------ The vendor provides a patch which should be installed immediately. Specific version information was not provided. Please contact the vendor in order to request the update. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Violation of the Least-Privilege Principle The application service is running in the context of a highly privileged user. An attacker managing to compromise the affected service, can run commands with these privileges. This vulnerability is not a direct Wertheim vulnerability but rather an installation problem. However, due to the following issues, an attacker would be able to exploit this problem and carry out actions with the permissions of the service account. 2) Broken WebSocket Authorization (CVE-2026-34023) Due to flaws in the authorization scheme, an authorization bypass vulnerability allows an attacker to get access to restricted functions and resources in other branches via the established WebSocket communication. To perform this attack an attacker has to be in the possession of valid user credentials of a low privileged branch user. 3) Broken access control (CVE-2026-34024) In the tested system multiple endpoints where identified which do not perform authorization checks. These endpoints may not be visible in the frontend but can be accessed anyway. This enables authenticated users with minimal privileges to, among others, perform the following actions: * Switch the user's branch * Upload arbitrary files * Download arbitrary files * View details of an arbitrary branch 4) IP Restriction Bypass (CVE-2026-34025) The web application restricts user logins based on the specific IP address associated to the branch's location. It was identified that the IP restriction can be bypassed by manipulating HTTP requests during the login process. 5) Path traversal (CVE-2026-34026) Due to insufficient application-side input validation, it is possible to request arbitrary files, accessible by the affected application, using a path traversal attack. This includes but is not limited to application-specific log files containing sensitive information. An existing session is required for this attack. However, it does not matter which role or permissions the utilized user possesses (see vulnerability 3). 6) Upload Restriction Bypass (CVE-2026-34027) As a result of insufficient application-side filetype validation it is possible to upload arbitrary files. An existing session is required to exploit this vulnerability. However, it does not matter which role or permissions the utilized user possesses (see vulnerability 3). 7) Unauthenticated Access to Web Data (CVE-2026-34028) An attacker has the ability to directly access HTTP endpoints which are not protected by any authorization scheme. The attacker is able to directly download files and execute binaries which are stored on the specific file path. 8) Hardcoded Secrets in DLL files (CVE-2026-34029) Application components were identified storing sensitive data in an insecure non-cryptographically protected format. An attacker with access to the application files can reverse engineer them and read out the hardcoded secrets. 9) Insufficient input validation (CVE-2026-34030) When a new branch is added to a company the chosen branch code is not validated correctly and therefore malicious symbols can be injected into it. This enables a malicious user to attack functions which actively use the branch code. The branch code is used in multiple occasions. Possible attacks include, but are not limited to, Cross-Site Scripting (XSS), path traversal attacks and all types of injections (OS Command, SQL, etc.). Special privileges ("settings_branches_manage") are needed to create a new branch. Privileges can be elevated using the vulnerability described in 3 and 5. 10) Undisclosed Vulnerability This vulnerability was identified during a reassessment commissioned by Wertheim. Detailed disclosure is withheld as the finding is subject to the vendor's ownership and disclosure authority. Affected parties are advised to contact the vendor directly for further information. The combination of 3), 5), 6), 7) and 9) leads to an authenticated remote code execution. If the service is running with high privileges (see 1), an attacker is able to fully compromise the whole server. The detailed proof-of-concept is shown in the chapter "Attack Chain" below. Proof of concept: ----------------- 1) Violation of the Least-Privilege Principle To verify the vulnerability, it is sufficient to search for the name "Wertheim Message Broker" in the list of running services. This can be done e.g., by using the "Windows Task Manager" and switching to the tab "Services". The tab shows the running services and visualizes, that the affected component is running in the context of the "NT AUTHORITY/SYSTEM" user. Image for Website PoC: Running_Services.png Caption: Message Broker running with NT AUTHORITY/SYSTEM privileges 2) Broken WebSocket Authorization (CVE-2026-34023) To demonstrate this vulnerability, an attacker has to login into the application. After a successful login, a WebSocket channel is established using the following endpoint. ``` https:// [HOST]:16181/SafeController/WebMessageBroker/connect?transport=webSockets&clientProtocol=1.5&connectionToken=AQAAANC[...]&connectionData=%5B%7B%22name%22%3A%22webmessagebroker%22%7D%5D&tid=7 ``` The response indicates a switch to the WebSocket protocol. ``` HTTP/1.1 101 Switching Protocols Upgrade: websocket Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: https://[HOST] Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Connection: Upgrade Sec-WebSocket-Accept: o0uZzjFdLQsU7HLpJvSMRyyK1t8= ``` The WebSocket channel is then used to send and receive messages between the server. For example, if access to a specific safe and vault is granted via the web application, a WebSocket message is sent to the server. To give an example, opening vault 13 in branch 2 via the web application will send the following WebSocket message to the server: ``` { "H": "webmessagebroker", "M": "ActivateBox", "A": [ "CTRL5400#Bank2", "13" ], "I": 8 } ``` The WebSocket message consists of two relevant parts: * Argument M: Describes the type of message. In this case "ActivateBox" is used to allow opening a box. * Argument A: Consists of two sub arguments: * "CTRL5400#Bank2": The ID of the controller. The first part describes the controller type and the second part the bank ID. * "13": The ID of the box. An attacker in possession of a valid controller ID (refer to vulnerability 3) can insert it into the above WebSocket request and thereby perform actions in arbitrary branches. For example, the following WebSocket request is sent by a user from bank2 and the controller ID is defined as the ID of branch 1. Additionally, it is passed as a parameter that box 1 is to be opened. ``` { "H": "webmessagebroker", "M": "ActivateBox", "A": [ "CTRL65000#Bank1", "1" ], "I": 3 } ``` Logging into the application as user from Bank1 shows that the box has been successfully activated. 3) Broken access control (CVE-2026-34024) To identify this issue a combination of the following research methods was performed: * Observing requests from users with elevated privileges and resending them, * Decompiling the software * Guessing endpoints. For example, by decompiling the software some endpoints which do not have the PermissionFilter option set were identified as it can be seen in the following function. ``` // SafeSystem.Web.Areas.SysAdmin.Controllers.BranchController // Token: 0x06000DEA RID: 3562 RVA: 0x00028C98 File Offset: 0x00026E98 public ActionResult Details(int Id) { this._sessionManagerService.SetCurrentBranchById(Id); BranchViewModel branchViewModel = new BranchViewModel(); base.SetViewModelProperties(branchViewModel); [...] ``` The following examples demonstrate the details on how to exploit the broken access control issues. **Example 1: Switch the user's branch** Due to missing authorization filters, it is possible to switch branches and companies with the permission of a low privileged user. To demonstrate the issue, it is sufficient to open the following URL within an active session of any user. ``` https:// [HOST]/Dashboard/Home/ChangeBranch?branchId=2 ``` The parameter branchId is an identifier for the branch where the user wants to switch, and it is only an incremented value. To exploit this issue, it is sufficient to increment the value until the right branch is reached. The server response to this issue with an HTTP 302 message and forwards the user to the dashboard of the new branch. ``` HTTP/2 302 Found Cache-Control: public, no-store, max-age=0 Content-Type: text/html; charset=utf-8 Expires: Tue, 07 Mar 2023 09:18:38 GMT Last-Modified: Tue, 07 Mar 2023 09:18:38 GMT Location: /dashboard Vary: * Server: Microsoft-IIS/10.0 X-Aspnetmvc-Version: 5.2 X-Frame-Options: DENY X-Aspnet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Tue, 07 Mar 2023 09:18:38 GMT Content-Length: 127 <html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="/dashboard">here</a>.</h2> </body></html> ``` It's also possible to switch whole companies with following URL. The parameter companyId is also an incremented value which can be easily enumerated by an attacker. ``` https:// [HOST]/Dashboard/Home/ChangeCompany?companyId=2 ``` **Example 2: Upload arbitrary files** Due to missing authorization filters, it is possible to store files persistently on the system with any application user. To demonstrate the issue, it is sufficient to send the following POST request w
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0340 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Wertheim SafeController Software for VAULT ROOMS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260615-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: Wertheim SafeController Software for VAULT ROOMS\n                     (Safe Deposit Locker System)\n vulnerable version: AssemblyVersion 6.15.8328.28014\n      fixed version: No information provided by vendor\n         CVE number: CVE-2026-34023, CVE-2026-34024, CVE-2026-34025,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2026-34026, CVE-2026-34027, CVE-2026-34028,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2026-34029, CVE-2026-34030\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://wertheim-safes.com/safe-deposit-box-management/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2023-04-03\n                 by: Christian Hager (Office Vienna)\n                     Gorazd Jank (Office Vienna)\n                     Philipp Espernberger (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"On September 1, 1852, Franz Wertheim and 85 employees began to build \"fireproof safes\".\nThen as now, Wertheim has been successfully involved in production of safes and banking\nfacilities, nationally and internationally. To secure the market position and develop\nnew business areas, Wertheim has continuously adapted its product range over the years\nas well as expanded its assortment of offerings. Today, the Wertheim Group of companies\nalso produces bank and object furnishings in our own joinery in Uttendorf, and\nCommissioned Work has developed into an essential business area for the group. The\ndiversity of state-of-the-art technologies characterizes the flexibility and technical\nknow-how of this division.\"\n\nSource:https://wertheim.at/en/company/ (2023)\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately. Specific version\ninformation was not provided. Please contact the vendor in order to request the\nupdate.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Violation of the Least-Privilege Principle\nThe application service is running in the context of a highly privileged user. An\nattacker managing to compromise the affected service, can run commands with\nthese privileges.\nThis vulnerability is not a direct Wertheim vulnerability but rather an installation\nproblem. However, due to the following issues, an attacker would be able to exploit\nthis problem and carry out actions with the permissions of the service account.\n\n2) Broken WebSocket Authorization (CVE-2026-34023)\nDue to flaws in the authorization scheme, an authorization bypass vulnerability\nallows an attacker to get access to restricted functions and resources in other\nbranches via the established WebSocket communication. To perform this attack an\nattacker has to be in the possession of valid user credentials of a low privileged\nbranch user.\n\n3) Broken access control (CVE-2026-34024)\nIn the tested system multiple endpoints where identified which do not perform\nauthorization checks. These endpoints may not be visible in the frontend but can\nbe accessed anyway. This enables authenticated users with minimal privileges to,\namong others, perform the following actions:\n* Switch the user\u0027s branch\n* Upload arbitrary files\n* Download arbitrary files\n* View details of an arbitrary branch\n\n4) IP Restriction Bypass (CVE-2026-34025)\nThe web application restricts user logins based on the specific IP address\nassociated to the branch\u0027s location. It was identified that the IP restriction\ncan be bypassed by manipulating HTTP requests during the login process.\n\n5) Path traversal (CVE-2026-34026)\nDue to insufficient application-side input validation, it is possible to\nrequest arbitrary files, accessible by the affected application, using a path\ntraversal attack. This includes but is not limited to application-specific\nlog files containing sensitive information. An existing session is required for\nthis attack. However, it does not matter which role or permissions the utilized\nuser possesses (see vulnerability 3).\n\n6) Upload Restriction Bypass (CVE-2026-34027)\nAs a result of insufficient application-side filetype validation it is possible\nto upload arbitrary files. An existing session is required to exploit this\nvulnerability. However, it does not matter which role or permissions the\nutilized user possesses (see vulnerability 3).\n\n7) Unauthenticated Access to Web Data (CVE-2026-34028)\nAn attacker has the ability to directly access HTTP endpoints which are not\nprotected by any authorization scheme. The attacker is able to directly\ndownload files and execute binaries which are stored on the specific file path.\n\n8) Hardcoded Secrets in DLL files (CVE-2026-34029)\nApplication components were identified storing sensitive data in an insecure\nnon-cryptographically protected format. An attacker with access to the application\nfiles can reverse engineer them and read out the hardcoded secrets.\n\n9) Insufficient input validation (CVE-2026-34030)\nWhen a new branch is added to a company the chosen branch code is not validated\ncorrectly and therefore malicious symbols can be injected into it. This enables\na malicious user to attack functions which actively use the branch code. The\nbranch code is used in multiple occasions. Possible attacks include, but are\nnot limited to, Cross-Site Scripting (XSS), path traversal attacks and all\ntypes of injections (OS Command, SQL, etc.).\nSpecial privileges (\"settings_branches_manage\") are needed to create a new\nbranch. Privileges can be elevated using the vulnerability described in\n3 and 5.\n\n10) Undisclosed Vulnerability\nThis vulnerability was identified during a reassessment commissioned by Wertheim.\nDetailed disclosure is withheld as the finding is subject to the vendor\u0027s ownership\nand disclosure authority. Affected parties are advised to contact the vendor\ndirectly for further information.\n\nThe combination of 3), 5), 6), 7) and 9) leads to an authenticated remote code\nexecution. If the service is running with high privileges (see 1), an attacker\nis able to fully compromise the whole server. The detailed proof-of-concept is\nshown in the chapter \"Attack Chain\" below.\n\n\nProof of concept:\n-----------------\n1) Violation of the Least-Privilege Principle\nTo verify the vulnerability, it is sufficient to search for the name \"Wertheim\nMessage Broker\" in the list of running services. This can be done e.g., by\nusing the \"Windows Task Manager\" and switching to the tab \"Services\". The tab\nshows the running services and visualizes, that the affected component is\nrunning in the context of the \"NT AUTHORITY/SYSTEM\" user.\n\nImage for Website PoC:\nRunning_Services.png\nCaption: Message Broker running with NT AUTHORITY/SYSTEM privileges\n\n\n2) Broken WebSocket Authorization (CVE-2026-34023)\nTo demonstrate this vulnerability, an attacker has to login into the application.\nAfter a successful login, a WebSocket channel is established using the following endpoint.\n\n```\nhttps:// \n[HOST]:16181/SafeController/WebMessageBroker/connect?transport=webSockets\u0026clientProtocol=1.5\u0026connectionToken=AQAAANC[...]\u0026connectionData=%5B%7B%22name%22%3A%22webmessagebroker%22%7D%5D\u0026tid=7\n```\n\nThe response indicates a switch to the WebSocket protocol.\n```\nHTTP/1.1 101 Switching Protocols\nUpgrade: websocket\nServer: Microsoft-HTTPAPI/2.0\nAccess-Control-Allow-Origin: https://[HOST]\nAccess-Control-Allow-Credentials: true\nX-Content-Type-Options: nosniff\nConnection: Upgrade\nSec-WebSocket-Accept: o0uZzjFdLQsU7HLpJvSMRyyK1t8=\n```\n\nThe WebSocket channel is then used to send and receive messages between the server.\nFor example, if access to a specific safe and vault is granted via the web application,\na WebSocket message is sent to the server.\nTo give an example, opening vault 13 in branch 2 via the web application will send\nthe following WebSocket message to the server:\n\n```\n {\n    \"H\": \"webmessagebroker\",\n    \"M\": \"ActivateBox\",\n    \"A\": [\n        \"CTRL5400#Bank2\",\n        \"13\"\n    ],\n    \"I\": 8\n}\n```\n\nThe WebSocket message consists of two relevant parts:\n* Argument M: Describes the type of message. In this case \"ActivateBox\" is used to allow\n  opening a box.\n* Argument A: Consists of two sub arguments:\n  * \"CTRL5400#Bank2\": The ID of the controller. The first part describes the controller\n                      type and the second part the bank ID.\n  * \"13\": The ID of the box.\n\n\nAn attacker in possession of a valid controller ID (refer to vulnerability 3)\ncan insert it into the above WebSocket request and thereby perform actions\nin arbitrary branches. For example, the following WebSocket request is sent\nby a user from bank2 and the controller ID is defined as the ID of branch\n1. Additionally, it is passed as a parameter that box 1 is to be opened.\n\n```\n{\n    \"H\": \"webmessagebroker\",\n    \"M\": \"ActivateBox\",\n    \"A\": [\n        \"CTRL65000#Bank1\",\n        \"1\"\n    ],\n    \"I\": 3\n}\n```\n\nLogging into the application as user from Bank1 shows that the box has been\nsuccessfully activated.\n\n\n3) Broken access control (CVE-2026-34024)\nTo identify this issue a combination of the following research methods was performed:\n* Observing requests from users with elevated privileges and resending them,\n* Decompiling the software\n* Guessing endpoints.\n\nFor example, by decompiling the software some endpoints which do not have the\nPermissionFilter option set were identified as it can be seen in the following function.\n```\n// SafeSystem.Web.Areas.SysAdmin.Controllers.BranchController\n// Token: 0x06000DEA RID: 3562 RVA: 0x00028C98 File Offset: 0x00026E98\npublic ActionResult Details(int Id)\n{\n        this._sessionManagerService.SetCurrentBranchById(Id);\n        BranchViewModel branchViewModel = new BranchViewModel();\n        base.SetViewModelProperties(branchViewModel);\n[...]\n```\n\nThe following examples demonstrate the details on how to exploit the broken access\ncontrol issues.\n\n**Example 1: Switch the user\u0027s branch**\n\nDue to missing authorization filters, it is possible to switch branches and\ncompanies with the permission of a low privileged user. To demonstrate the\nissue, it is sufficient to open the following URL within an active session of any user.\n```\nhttps:// [HOST]/Dashboard/Home/ChangeBranch?branchId=2\n```\nThe parameter branchId is an identifier for the branch where the user wants to switch,\nand it is only an incremented value. To exploit this issue, it is sufficient to\nincrement the value until the right branch is reached.\n\nThe server response to this issue with an HTTP 302 message and forwards the user to\nthe dashboard of the new branch.\n\n```\nHTTP/2 302 Found\nCache-Control: public, no-store, max-age=0\nContent-Type: text/html; charset=utf-8\nExpires: Tue, 07 Mar 2023 09:18:38 GMT\nLast-Modified: Tue, 07 Mar 2023 09:18:38 GMT\nLocation: /dashboard\nVary: *\nServer: Microsoft-IIS/10.0\nX-Aspnetmvc-Version: 5.2\nX-Frame-Options: DENY\nX-Aspnet-Version: 4.0.30319\nX-Powered-By: ASP.NET\nDate: Tue, 07 Mar 2023 09:18:38 GMT\nContent-Length: 127\n\n\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eObject moved\u003c/title\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch2\u003eObject moved to \u003ca href=\"/dashboard\"\u003ehere\u003c/a\u003e.\u003c/h2\u003e\n\u003c/body\u003e\u003c/html\u003e\n```\n\nIt\u0027s also possible to switch whole companies with following URL. The parameter\ncompanyId is also an incremented value which can be easily enumerated by an\nattacker.\n```\nhttps:// [HOST]/Dashboard/Home/ChangeCompany?companyId=2\n```\n\n**Example 2: Upload arbitrary files**\n\nDue to missing authorization filters, it is possible to store files persistently\non the system with any application user. To demonstrate the issue, it is\nsufficient to send the following POST request w"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/8"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://wertheim-safes.com/safe-deposit-box-management/"
        },
        {
          "url": "https://wertheim.at/en/company/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260615-0 :: Multiple Critical Vulnerabilities in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34023",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34024",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34025",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34026",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34027",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34028",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34029",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34030",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0340",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/8",
            "automated": true,
            "contentSha256": "34d24134677464b18285a181ecc5c3871b572dd0c08cce2e6944557f9090495a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-15T12:06:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0340"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T07:55:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0340"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.