What is the CVSS score of CVE-2026-12691?

CVE-2026-12691 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Enterprise Video Platform are affected by CVE-2026-12691?

Vimesoft Enterprise Video Platform versions 3.11.0 through 3.24.x contain an unauthenticated authentication bypass that allows attackers to directly access confidential video content and associated…. A patch is available.

How to fix or mitigate CVE-2026-12691?

Within 24 hours: identify all Vimesoft instances and confirm which versions are deployed (particularly 3.11.0-3.24.x); review access logs for anomalous external connections. Within 7 days: contact Vimesoft Support to confirm patch timeline and available workarounds; implement network-layer restrictions limiting platform access to authorized internal networks and requiring VPN authentication for remote users. Within 30 days: upgrade to patched version (3.25.0 or later) once available from vendor; validate the update in a non-production environment before production deployment.

Enterprise Video Platform CVE-2026-12691

EUVD-2026-45219 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-17 TR-CERT

GHSA-9855-g484-jffw

Authentication Bypass Enterprise Video Platform

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 17, 2026 - 18:33 EUVD

Analysis Generated

Jul 17, 2026 - 17:15 vuln.today

CVE Published

Jul 17, 2026 - 16:32 cve.org

HIGH 7.5

DescriptionNVD

Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass.

This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

AnalysisAI

Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) allows remote unauthenticated attackers to reach a critical function that lacks any authentication check, exposing confidential data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) indicates trivial network exploitation with high confidentiality impact but no integrity or availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw was reported by Turkey's national CERT (TR-CERT / USOM).