PT-2026-26307 · Unknown · Opexus Ecase+1

Adam Rose · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-32865

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint and eCASE versions prior to 10.1.0.0

Description The application includes the secret verification code in the HTTP response when a password reset is requested via the ForcePasswordReset.aspx endpoint. An attacker with knowledge of a user's email address can reset the user's password and bypass security questions, as they are not required during the process. The vulnerable parameter is not explicitly mentioned.

Recommendations Versions prior to 10.1.0.0 should be updated to version 10.1.0.0 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-640

Identificadores relacionados

CVE-2026-32865

Produtos afetados

Opexus Ecase

Opexus Ecomplaint

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-32865 · Nota de Segurança
• https://twitter.com/CVEnew/status/2036024202638373262 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2034663490212782404 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2034718260130980189 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2034671999067304120 · Publicação no Twitter
• https://twitter.com/_substrg_/status/2034676587430355302 · Publicação no Twitter
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json · Nota
• https://cve.org/CVERecord?id=CVE-2026-32865 · Nota de Segurança