EUVD-2026-67135
GHSA-qgvf-2v68-gv59
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible with no authentication; impact is strictly limited confidentiality via account enumeration, with no integrity or availability effect.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting.
This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
AnalysisAI
Account footprinting via observable discrepancy in Seres Software syWEB exposes valid user account existence to unauthenticated remote attackers. All versions through 27082026 are affected, and the vendor has confirmed the product is end-of-life with no support - meaning no patch will ever be released. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against the default configuration of syWEB when it is network-accessible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.3 (Medium) reflects a limited-scope confidentiality impact - account enumeration does not directly enable account takeover, but it is a meaningful reconnaissance primitive that can feed credential-stuffing or phishing campaigns. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis, and none is expected - the vendor has confirmed syWEB is unsupported. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today