PT-2026-26307 · Unknown · Opexus Ecase+1

Adam Rose · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-32865

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint and eCASE versions prior to 10.1.0.0

Description The application includes the secret verification code in the HTTP response when a password reset is requested via the ForcePasswordReset.aspx endpoint. An attacker with knowledge of a user's email address can reset the user's password and bypass security questions, as they are not required during the process. The vulnerable parameter is not explicitly mentioned.

Recommendations Versions prior to 10.1.0.0 should be updated to version 10.1.0.0 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-640

Related Identifiers

CVE-2026-32865

Affected Products

Opexus Ecase

Opexus Ecomplaint

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-32865 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-32865 · Security Note
• https://twitter.com/CVEnew/status/2036024202638373262 · Twitter Post
• https://twitter.com/0dayPublishing/status/2034663490212782404 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034718260130980189 · Twitter Post
• https://twitter.com/CveFindCom/status/2034671999067304120 · Twitter Post
• https://twitter.com/_substrg_/status/2034676587430355302 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json · Note