PT-2026-21798 · Unknown · Eventsentry

Vulncheck · Published 2026-02-24 · Updated 2026-02-25 · CVE-2026-24443

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EventSentry versions prior to 6.0.1.20

Description EventSentry has a flaw where passwords can be changed without verifying the current password through the account management functionality within the Web Reports interface. An attacker gaining access to an authenticated user session can modify the account password without knowing the original credentials. This allows for persistent account takeover, potentially leading to privilege escalation if administrative accounts are compromised.

Recommendations Update EventSentry to version 6.0.1.20 or later.

Fix

LPE

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2026-24443

Affected Products

Eventsentry

References · 6

• https://osv.dev/vulnerability/CVE-2026-24443 · Vendor Advisory
• https://eventsentry.com/downloads/version-history · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24443 · Security Note
• https://vulncheck.com/advisories/eventsentry-web-reports-unverified-password-change · Vendor Advisory
• https://t.me/CVEtracker/45659 · Telegram Post
• https://twitter.com/CVEnew/status/2026676425500275158 · Twitter Post