PT-2026-26309 · Unknown · Opexus Ecomplaint

Adam Rose · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-32867

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint versions prior to 10.1.0.0

Description An unauthenticated attacker can obtain or guess an existing case number and upload arbitrary files via the 'Portal/EEOC/DocumentUploadPub.aspx' endpoint. Uploading a large number of files could consume storage, and users would see these unexpected files in cases. The vulnerable parameter is the file uploaded through the specified endpoint.

Recommendations Update OPEXUS eComplaint to version 10.1.0.0 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-425

CWE-639

Identificadores relacionados

CVE-2026-32867

Produtos afetados

Opexus Ecomplaint

Referências · 6

• https://twitter.com/CVEnew/status/2036024200868286684 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034705898564735060 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-32867 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-32867 · Nota de Segurança
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json · Nota
• https://twitter.com/cyberbivash/status/2034677171021554157 · Publicação no Twitter