An out-of-bounds write in MediaTek baseband/modem firmware (patch IDs MOLY01874018 and MOLY01774038) allows radio-adjacent attackers to corrupt modem memory and escalate privileges on Android devices running any of the affected MT-series chipsets. The attacker must operate a rogue base station and the target UE must actually connect or attach to it before a malformed modem message can reach the unchecked code path; once attached, no authentication and no user interaction are required, and the flaw yields high confidentiality, integrity and availability impact (CVSS 3.1 7.5, AV:A/AC:H/PR:N/UI:N). Exploitation is not confirmed in the wild, SSVC marks it non-automatable, and no public exploit or PoC has been identified at time of analysis, though the rogue-base-station priming technique itself is well established.
MediaTek modem firmware contains an out-of-bounds write that can be triggered when a user equipment connects to a rogue base station, allowing the attacker to escalate privileges on the affected device. The issue affects a broad set of MediaTek chipsets covered by the November 2026 vendor bulletin; no authentication or user interaction is required once the device attaches, but the attacker must be within radio proximity and operate rogue cellular infrastructure, so the attack is targeted rather than remotely scalable over the internet. No public exploit is identified at time of analysis, and SSVC records Exploitation: none; the vuln.today decision label is this_week.
An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker who operates a rogue base station to escalate privileges on a victim handset once the device attaches to that cell, with no authentication or user interaction required after attachment. The flaw is a missing bounds check on data handled across the baseband signaling path and affects a very broad set of MediaTek chipsets, including MT6765, MT6761, MT6768, MT6789, MT6833, MT6853, MT6877, MT6895, MT6983 and MT6991 among many others listed in EUVD-2026-115009. MediaTek has assigned Patch ID MOLY01857954 and published it in the November 2026 product security bulletin; no public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the issue as not automatable, and this is a genuine but conditional priority rather than a drop-everything emergency because the attacker must be within cellular radio range with rogue radio infrastructure.
An out-of-bounds write in MediaTek modem baseband firmware lets an attacker who operates a rogue base station escalate privileges on an affected device once the victim UE attaches to that cell, with no authentication and no user interaction required. The flaw affects a broad set of MediaTek MT6xxx/MT8xxx chipsets (including MT6897, MT6988, MT6991, MT6993, MT8678 and MT8755) and carries a 7.5 CVSS score, though the vector's AC:H and CISA SSVC's Automatable:no indicate that successful triggering depends on non-trivial conditions and targeted effort rather than opportunistic mass scanning. No public exploit code was identified at time of analysis and SSVC records Exploitation: none; MediaTek has published patch ID MOLY01877236 in its November 2026 product security bulletin, and the priority signal is 'this_week' rather than an emergency.
Out-of-bounds write in MediaTek modem firmware enables a rogue base station operator to escalate privileges on a connected user equipment (UE) without authentication or user interaction. The flaw (CWE-787, missing bounds check) affects a broad set of MediaTek chipsets and is fixed by patch MOLY01876662 in MediaTek's November 2026 security bulletin. Exploitation is conditional: the attacker must operate a malicious cell and hold the target's radio attachment, so SSVC marks it not automatable, and no public exploit has been identified at time of analysis.
Out-of-bounds reads and writes in psqlODBC before 18.00.0006 arise when a host application forwards untrusted column numbers or row indices into ODBC entry points such as SQLBindCol, SQLColAttribute and SQLSetPos(SQL_ADD), which the driver uses directly as array indices without validation. This is not a default-configuration remote condition: the limiting factor is that the calling application must itself relay attacker-controlled index values to these APIs, which is why the assessed vector carries high attack complexity (AC:H) and a low-privilege requirement (PR:L) alongside high confidentiality, integrity and availability impact. No public exploit identified at time of analysis; the vendor fix is psqlODBC 18.00.0006.
SQL injection in psqlODBC before 18.00.0006 allows an attacker who can influence a table or schema name passed by a host application to SQLSpecialColumns to execute arbitrary SQL with the privileges of the existing database connection. Only SQLSpecialColumns is affected because it fails to escape these identifiers, while the other catalog functions do escape them; applications that pass only trusted or hardcoded identifiers to that function are not exploitable. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit was identified at time of analysis.
A stack-based buffer overflow (CWE-121) in the psqlODBC driver, the official PostgreSQL ODBC driver, lets attacker-influenced SQL text corrupt the memory of any application that forwards it through the driver. Two triggers exist: a {fn ...} ODBC escape with more than 16 argument offsets overflows a fixed 16-entry stack array (and referencing an unsupplied argument copies uninitialized bytes into the query), while copying the body of a {d}, {t}, {ts}, or {escape} escape writes one byte past a 128-byte stack buffer. All versions before 18.00.0006 are affected; no public exploit code was identified at time of analysis, and exposure is confined to applications that pass raw, untrusted SQL text to the driver rather than parameterized queries.
Heap out-of-bounds write in the psqlODBC driver (CWE-787) affects all versions before 18.00.0006 and is reachable only when the UseDeclareFetch option is enabled. The driver sizes its row cache from the column count of a cursor's first result, then accepts a different column count from later FETCH replies; a PostgreSQL server that is not trusted under the current SSL settings can return extra columns and drive writes past the end of the heap allocation, with a keyset reply containing fewer columns than the key fields also causing an unsigned field-count underflow. Unauthenticated remote attackers can exploit this only from a malicious or impersonated backend position, requiring user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-released fix is 18.00.0006.
A heap buffer overflow in psqlODBC's large-object read path lets a malicious or man-in-the-middle PostgreSQL server overwrite adjacent memory in the client process with server-chosen bytes: the driver trusts the byte count in the loread reply and copies that many bytes into the application-supplied buffer without comparing it to the buffer size. All psqlODBC versions before 18.00.0006 are affected, and any application that fetches a large-object column triggers the vulnerable code path. Exploitation is conditional rather than opportunistic - the client must connect to a server it does not trust under its current SSL settings (for example with certificate verification disabled) or an attacker must hold a man-in-the-middle position, and the assessed vector (AC:H, UI:R, PR:N) reflects that a network position or rogue server plus a large-object fetch is required; no public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so priority is patch-this-cycle rather than emergency response.
Remote unauthenticated denial of service in Nut/OS allows an attacker who can reach any listening TCP port to send a single TCP segment carrying an unknown TCP option with a zero length byte, causing an infinite loop in NutTcpInputOptions and hanging all TCP-based services until the device is rebooted. Releases up to and including Nut/OS 5.1 are affected; the flaw is availability-only, with no confidentiality or integrity impact and no code execution. No public exploit was identified at time of analysis, and CISA SSVC records exploitation as none, though the attack is automatable and the device must expose a reachable TCP service.
Unauthenticated SQL injection in Starnet Computer and Network Systems' Inventory Tracking Application (all builds through 2026-10-16) lets remote attackers reach the backend database and read data they should never see, rated CVSS 3.1 7.5 with confidentiality-only impact (C:H/I:N/A:N). Per the vector AV:N/AC:L/PR:N/UI:N, no credentials and no user interaction are required, so any internet- or network-exposed deployment on a default configuration is directly reachable. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV; practical risk is dominated by deployment scarcity, since the product has a very small installed base and only exposed instances are realistically at risk (vuln.today priority: this_week).
A denial-of-service flaw in the HarmonyOS window module can degrade or disrupt availability on affected devices, scored 7.5 by the vendor as network-reachable (AV:N/AC:L/PR:N/UI:N) but availability-only (C:N/I:N/A:H). Huawei published the fix details across three separate October 2026 bulletins covering phones, wearables and laptops, so the exposed population spans multiple device classes running unpatched HarmonyOS builds. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and no EPSS score was supplied; the vuln.today priority label is 'this_week'. The exact protocol and input needed to trigger the crash are not described in the available sources, and the AV:N assignment for a UI/display subsystem component should be verified against the bulletin before treating remote exposure as confirmed.
MediaTek modem firmware contains an out-of-bounds write that can be triggered when a user equipment (UE) attaches to a rogue base station controlled by the attacker, enabling remote privilege escalation without additional execution privileges and without user interaction. The flaw affects numerous MediaTek chipsets running firmware prior to the November 2026 patch (MOLY01338165; MSV-9660). Exploitation requires radio-proximity access and a high-complexity rogue base station setup; no public exploit has been identified at time of analysis.
Privilege escalation in MediaTek modem firmware is possible when a user equipment connects to a rogue base station, where an out-of-bounds write lets an attacker corrupt memory and gain elevated execution on devices built on a broad range of MediaTek chipsets. Exploitation requires the attacker to operate malicious cellular radio infrastructure within range and induce the target to attach; once that precondition is met, no authentication or user interaction is required. No public exploit has been identified at the time of analysis, and CISA SSVC records exploitation as none with automatable set to no, supporting a serious-but-not-emergency priority.
Denial of service in OpenAirInterface CN5G AMF v2.2.1 allows a remote, unauthenticated attacker to crash the AMF process by sending a crafted NAS Registration Request containing a malformed IMEISV in the 5GS Mobile Identity IE. The root cause is an integer truncation (CWE-197) in the NAS decoder: Type6NasIe::Validate() truncates a 32-bit length to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(). CVSS 3.1 is 7.5 with availability-only impact; delivery requires NAS/N1 signaling access, normally through a gNB or the N2 reference point, so exposure is not equivalent to an internet-facing service. No CISA KEV listing or confirmed active exploitation is reported; a public gist reference exists but is not verified as working exploit code.
A stack-based buffer overflow in the OpenAirInterface CN5G UDM (v2.2.1) lets an unauthenticated network attacker who can reach the Service-Based Interface and supply a valid SUPI crash the UDM process by sending an oversized hex string in resynchronizationInfo.rand or auts to the Nudm_UEAU Generate Authentication Data endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N, A:H) rates this 7.5, but real-world exposure is constrained: the SBI is normally an internal, segmented network between 5G core functions rather than an internet-facing surface, and the demonstrated outcome is stack-canary corruption leading to process termination, not code execution. No CISA KEV entry exists; a public gist reference is linked in the advisory data, but it is not verified as working exploit code, so treat this as a credible DoS bug with a potentially high blast radius for core-network availability rather than a confirmed actively exploited flaw.
Unauthenticated remote denial of service in Kamailio 6.1.3 and 6.1.4: a crafted SIP REGISTER request carrying an oversized host field in the Via header is copied into a fixed 46-byte stack buffer by w_rx_aar_register() in the ims_qos_npn module, corrupting the stack and terminating the affected instance. Exposure is not universal - the ims_qos_npn module must be loaded and routing must actually invoke w_rx_aar_register() on incoming REGISTERs, which in practice means IMS/VoLTE QoS deployments rather than a default SIP proxy; for those systems the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H only) means any remote sender can trigger the crash with no credentials or user interaction. The issue is not in CISA KEV; a public gist linked from the CVE record is a possible PoC reference that is not verified as working exploit code, and priority per vuln.today is remediation this week rather than emergency response.
Local privilege escalation in the Android kernel arises from a race condition that can corrupt memory in multiple kernel locations, letting an unprivileged local process gain elevated code execution (CWE-362, CVSS 7.4). Only devices running an Android kernel without the upstream fixes are affected; the attacker must already be running code on the device as an ordinary app or process, needs no additional execution privileges, and no user interaction is required. The race window is narrow and timing-dependent (AC:H), EPSS is low at 0.26% (18th percentile), no public exploit has been identified at time of analysis, and this is a genuine but non-emergency priority tracked for the current week rather than an emergency response.
Local privilege escalation in Android's protected KVM (pKVM) hypervisor, where a race condition in __pkvm_pages_to_ppages (mmu.c) can produce an out-of-bounds write and yield high confidentiality, integrity and availability impact at the hypervisor level. Only devices running pKVM - the protected KVM hypervisor present on newer ARM64 Android hardware - are exposed, and the attacker must already execute local code and win a timing-dependent race, which is captured by AC:H and materially limits reliability. No public exploit code has been identified at time of analysis, EPSS is low at 0.16% (5th percentile) and SSVC records no exploitation, making this a genuine but second-tier priority; the vendor fixes are referenced in AOSP kernel commits and the November 2026 Android Security Bulletin.
Local privilege escalation in the Android kernel's ARM LPAE IOMMU page-table code (arm_lpae_split_blk_unmap in io-pgtable-arm-common.c), where a race condition during block-unmap/split operations can corrupt memory. Any app that can execute code locally on an affected device can attempt the attack without elevated privileges or user interaction, though the race window must be won - SSVC rates the flaw non-automatable and EPSS is only 0.15%, so real-world exploitation is unreliable and device-dependent. No public exploit or active exploitation is confirmed (Exploitation: none per SSVC); the issue is addressed in the Android Security Bulletin dated 2026-11-01.
Privilege escalation in Rancher Manager's GlobalRole handling lets a non-administrative user who already holds delegated rights to manage management.cattle.io globalroles and globalrolebindings grant permissions in downstream clusters that exceed their own, because the inheritedNamespacedRules field escaped the escalation validation applied to other permission-carrying GlobalRole fields. Affected deployments are SUSE Rancher 2.15.x where the field exists (reported as 2.15.2, fixed in 2.15.3) and the bundled rancher-webhook 0.11.0 through 0.11.3 and 0.12.0 (fixed in 0.11.4 and 0.12.1); 2.14.x and earlier lack the field and are not affected. The prerequisite is a high-privilege delegated role rather than ordinary cluster access, and administrators gain no escalation, which limits the practical attacker population; no public exploit code is identified in the available data, and no KEV entry is noted.
The StageIt extension for Joomla (published by php-web-design.com) performs state-changing actions without adequate cross-site request forgery protection, so an attacker who can lure a logged-in Joomla user or administrator to a malicious page or crafted link can cause those actions to be executed with the victim's privileges. Versions 1.0 through 5.7.5 and 6.0 through 6.3.5 are affected, and the impact is rated high for both integrity and availability (CVSS 4.0 base 7.2; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), with no confidentiality impact. Exploitation requires an authenticated victim session and user interaction, the attacker needs no credentials, and no public exploit code or confirmed active exploitation is identified in the available sources; priority is triaged as remediation this week.
Persistent denial of service in Absolute Secure Access servers prior to 14.61 is reachable by an authenticated attacker who connects for the first time, where missing length validation can be abused to disrupt availability. The flaw requires valid low-privilege credentials (PR:L) and no victim interaction, and servers at 14.61 or later are fixed. No public exploit was identified at time of analysis, and this is assessed as a moderate-priority availability issue rather than a critical emergency.
Authenticated users of Absolute Secure Access servers running versions prior to 14.61 can supply improperly handled input that results in a persistent denial of service, leaving the service impaired beyond the initial request. The flaw is network-reachable at low complexity and requires no user interaction, but it does require a valid authenticated session (CVSS PR:L), so only accounts able to log in to the server can reach it. Absolute addresses the issue in 14.61; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Incorrect default permissions in Dell Alienware Command Center (AWCC) before version 6.14.54.0 allow a low-privileged local user to tamper with files or resources the component installs with overly permissive access controls, producing a high integrity impact and a lesser availability impact while leaving confidentiality untouched. Exploitation requires the product to be installed and the attacker to already hold a local account on the host; there is no network vector, and no user interaction is needed. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit was identified at time of analysis, so it warrants prioritized remediation on affected gaming endpoints rather than emergency response, with the vendor fix available as AWCC 6.14.54.0.
SQL injection in psqlODBC before 18.00.0006 can let an authenticated database user who can create a table that an application reads with an updatable cursor manipulate the driver's keyset and positioned SQL, including which rows a positioned UPDATE or DELETE affects. The flaw triggers when the table lacks OIDs, uses an auto-increment int4 column as the row identifier, and that column's server-reported name contains a double quote that the driver fails to escape. No public exploit identified at time of analysis; exploitation is conditional on the application using updatable cursors and performing positioned operations, and requires user interaction per the CVSS vector.
Camaleon CMS releases before 2.9.2 enforce only authentication, not authorization, on the Admin::MediaController endpoints that handle uploads, private file downloads, cropping and media actions, letting any logged-in user whose role lacks the media manager permission reach those functions by direct URL or POST. A low-privileged authenticated attacker can therefore store files via /admin/media/upload, read private media through download_private_file, and use crop with saved_avatar to alter other users' avatars, producing a high confidentiality impact with limited integrity impact. The vendor has released 2.9.2 with a centralized before_action check, so no public exploit code or active exploitation is indicated in the available data; the CVSS 4.0 base score is 7.1 and priority is this_week, reflecting a real but not emergency-grade issue given the authenticated-account prerequisite.
Authorization bypass in Chatify, the Laravel live-chat package (munafio/chatify), before version 1.6.4 lets any authenticated user subscribe to another user's private inbox channel. By POSTing to the package's Pusher authorization endpoint (/chat/auth) with an arbitrary channel name of the form private-chatify.<victim id> and a socket id, an attacker obtains a valid Pusher signature and receives the victim's incoming private messages and attachments in real time. The victim's user id is a sequential integer, so enumeration is trivial; the only prerequisite is a valid account on the target instance (PR:L, network reachable, no user interaction) and the impact is confidentiality-only, with no message injection or tampering. A vendor fix exists in 1.6.4; no public exploit code was identified at time of analysis, although a technical writeup of the bypass is publicly available, and the issue is rated for remediation this week.
This is a moderate-priority issue rather than an emergency: insufficient permission enforcement (CWE-264) in the event notification management module of Huawei HarmonyOS and EMUI allows an attacker who already holds a local foothold, such as an installed application, to reach notification-management functionality or data beyond what that app should be permitted to access, with low confidentiality impact and no integrity or availability impact in the assessed vector. The assessed CVSS score is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, meaning the attack is local, requires user interaction, needs no privileges, and has high complexity because exploitation conditions are not fully attacker-controlled. No public exploit code has been identified and the CVE is not listed in CISA KEV; the only references are Huawei bulletin index pages that carry no per-CVE technical detail.
An out-of-bounds write in MediaTek modem firmware can be triggered when a user equipment (UE) attaches to a rogue base station and processes a malformed message, potentially giving the attacker privilege escalation on the device; the CVSS 3.1 score is 7.1 (AV:A/AC:H/PR:N/UI:R). Exploitation is constrained by the need to operate cellular radio infrastructure in adjacent range and to induce user interaction, and SSVC records exploitation as none and automatable as no. MediaTek has published a fix under Patch ID MOLY01911177 (issue MSV-10122) in its November 2026 bulletin; no public exploit was identified at time of analysis.
A use-after-free in the Linux kernel's core-dump teardown path lets a local, low-privileged user who can drive a multithreaded process into a core dump corrupt kernel memory by winning a narrow race in coredump_finish(). The function clears the parked thread's ->task entry and then calls wake_up_process() without holding a task reference or being inside an RCU read-side section, so a preemption between the store and the wakeup lets the thread exit and be freed, after which try_to_wake_up() acquires pi_lock in freed memory. Scoring is CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0); no public exploit code was identified at time of analysis, and the high attack complexity and local-only, low-privilege preconditions keep real-world risk below the base score, with a vuln.today priority of this_week.
Local use-after-free in the Linux kernel key-management subsystem: keyctl_describe_key() (KEYCTL_DESCRIBE) passes key->type->name into kasprintf() without holding key->sem, so the retained key reference pins the key but not the module that supplies its type. If a privileged module unload (the description cites af_rxrpc_exit() with AF_RXRPC built as a module, =m) retires the type and free_module() releases the name between the formatter's two allocation-separated passes, the second pass reads freed module storage and faults in string(). Affected are kernels whose key type is provided by a loadable module, where a local user holding at least View permission on such a key races a concurrent module unload; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H, reflecting local-only, narrow-window exploitation that can crash the kernel and read stale kernel memory, but not a controllable write. No public exploit code or PoC reference and no CISA KEV entry were reported, and exploitation requires a privileged module unload the unprivileged attacker does not control, so this is not an internet-facing emergency - though the published stable-tree fixes should be picked up this week.
Out-of-bounds write in the Cortex-M module ports of Eclipse ThreadX 6.0.1 through 6.5.2.202603 lets a user-mode, memory-protected module thread escape its sandbox: the PendSV handler saves the preempted thread's callee-saved registers and EXC_RETURN value in privileged mode at addresses taken from the thread's process stack pointer without checking it against the thread's stack, so a module that places its stack pointer just above a writable region has up to nine words (25 with floating-point state) written below that region and read back on the next switch-in, and PendSV later branches in Handler mode to the reloaded EXC_RETURN slot. Exploitation is local only (CVSS:4.0 PR:L, assessed CVSS:3.1 PR:L with Scope Changed), requires a system using the Module Manager that loads a user-mode memory-protected module the attacker already controls, and leaves kernel-mode threads and systems without loadable memory-protected modules unaffected; no public exploit code was identified at the time of analysis and the issue is not in CISA KEV, with vendors shipping a fix in ThreadX 6.5.2.202603b.
Stack- and heap-based buffer overflows in libgphoto2 through 2.5.34's jl2005c_init() can corrupt memory and potentially permit code execution when a malicious USB device impersonates a Jeilin JL2005B/C/D camera. Exploitation requires physical attachment of the spoofed device; once enumerated by the jl2005c driver, a device-reported allocation-table entry count of 1022 or more overflows the local stack 'info' buffer and the heap priv->table buffer. The attack needs no authentication or user interaction beyond device enumeration, and the supplied data identifies upstream fixes but no confirmed active exploitation (CISA KEV) or verified working exploit code.
SQL injection in Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3 lets an authenticated administrator holding adequate entitlements pass unsanitized opEvent parameters into SQL statements and, where the backing database permits stacked queries, execute arbitrary SQL. It is an incomplete fix for CVE-2026-77051, so installations remediated only against that earlier CVE remain exposed. The vendor directs users to upgrade to 4.0.9 or 4.1.4; no public exploit code or confirmed active exploitation was identified at time of analysis, and the high-privilege administrator prerequisite is the main constraint on realistic abuse.
Apache Syncope administrators who hold entitlements for the Implementations feature can define a malicious Groovy class that executes untrusted code on a separate thread, escaping the Groovy security sandbox and compromising the application's confidentiality, integrity, and availability. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3; exploitation requires a high-privilege administrative account, so exposure is limited to deployments where Implementations access is broadly delegated. No public exploit identified at time of analysis, and the vendor directs users to upgrade to 4.0.9 or 4.1.4.
Authorization bypass in Apache Syncope allows an authenticated delegated administrator to relocate a Realm subtree across administrative realm boundaries without holding permission on the destination realm, giving the attacker unwarranted write influence over resources outside their delegated scope (integrity impact) with limited read exposure. Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3, and the vendor recommends upgrading to 4.0.9 or 4.1.4. Exploitation requires a valid delegated-admin account in Syncope - there is no unauthenticated path - and no public exploit code or active exploitation has been identified at time of analysis.
Improper privilege management in Apache Syncope 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8 and 4.1.0-M0 through 4.1.3 allows an authenticated non-admin account that is permitted to perform AuthProfile self-updates to configure impersonation used by WA (Web Access) surrogate authentication, effectively letting a low-privileged user act as another identity. Our assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - network-reachable, authenticated (PR:L), no user interaction, with high confidentiality and integrity impact and no availability impact - because the flaw grants an authorization bypass rather than code execution. Exploitation requires a valid low-privilege account plus a deployment that actually uses WA surrogate authentication; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so priority is scheduled patching (this_week) rather than emergency response.