Advanced Authentication Server CVE-2026-112256

The flaw (CWE-349, acceptance of extraneous untrusted data with trusted data) lets an attacker reach functionality not properly constrained by ACLs on the Advanced Authentication Server. Per the CVSS vector (PR:N/UI:N/AC:L, AV:N) it is reachable remotely with no authentication and no user interaction against the listed versions (6.4.0.0-6.4.3.8, 6.5.0.0-6.5.0.10, 6.6.0.0-6.6.1.0), and AU:Y indicates it is automatable; no special feature-enablement or non-default configuration is identified as a prerequisite in the available advisories. The limiting factor is version: deployments already on 6.4.3.9, 6.5.0.11, or 6.6.2 (release 26.3.1) are out of scope. The exact untrusted-data element, request parameter, or endpoint that must be manipulated to trigger the ACL bypass is not described in the sources provided, so the concrete trigger is unverified.

Multiple signals converge on this being a genuine high priority rather than a paper-high score. The vendor-supplied CVSS 4.0 vector (9.2) is AV:N/AC:L/PR:N/UI:N - remotely reachable, low attack complexity, no authentication, no user interaction - with high confidentiality and integrity impact (VC:H/VI:H) and, importantly, a scope change propagating high impact to subsequent systems (SC:H/SI:H), which is consistent with a flaw in an authentication server that gates access to downstream protected resources. The threat/supplemental metrics reinforce urgency: AU:Y (automatable), U:Red (vendor's own urgency rating is Red), and the vuln.today decision label is act_now. The CVSS 4.0 vector carries E:P (proof-of-concept exploit maturity); however, no PoC/exploit reference is present in the supplied references, so this is a maturity flag rather than a verified public exploit. There is no CISA KEV entry in the input (so not confirmed actively exploited) and no EPSS score was provided, so widespread-exploitation probability cannot be quantified here. Net assessment: unauthenticated, automatable ACL bypass in an IAM/MFA product with vendor-declared Red urgency and act_now priority - treat as a real, urgent priority and patch without delay; the main uncertainty is the exact trigger mechanism and real-world exploitation breadth, not the severity.

A remote, unauthenticated attacker sends a crafted request to the Advanced Authentication Server that bundles extraneous untrusted data alongside trusted data (CWE-349); the server honors the untrusted portion and the attacker reaches functionality that should be restricted by ACLs, exposing or altering protected authentication functions and, via the scope change, downstream systems that rely on it. The CVSS 4.0 vector carries E:P (proof-of-concept maturity), but no public PoC reference is included in the provided data, so working exploit code is not confirmed from the sources.