What is the CVSS score of CVE-2026-12692?

CVE-2026-12692 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Enterprise Video Platform are affected by CVE-2026-12692?

Vimesoft Enterprise Video Platform versions 3.11.0.0 through 3.24.x contain a critical unauthenticated password-reset vulnerability (CVSS 9.8) enabling remote attackers to seize control of any user…. A patch is available.

How to fix or mitigate CVE-2026-12692?

Within 24 hours: Inventory all systems running Vimesoft Enterprise Video Platform versions 3.11.0.0 through 3.24.x and restrict their network accessibility from untrusted sources; activate security monitoring to baseline password-change activity and establish incident response readiness. Within 7 days: Deploy heightened audit logging for all account modifications and authentication events, implement IP whitelisting on administrative interfaces, enforce multi-factor authentication on all accounts, and establish 24/7 monitoring for suspicious password-reset patterns or concurrent access from anomalous locations. Within 30 days: Upgrade all systems to Vimesoft Enterprise Video Platform version 3.25.0 or later upon vendor confirmation of patch availability, conduct forensic review of account-activity logs for evidence of unauthorized access during the vulnerability window, and perform post-remediation security validation.

Enterprise Video Platform CVE-2026-12692

EUVD-2026-45220 CRITICAL

Unverified Password Change (CWE-620)

2026-07-17 TR-CERT

GHSA-jwxw-5646-6rgf

Authentication Bypass Enterprise Video Platform

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable password-change endpoint requires no auth or interaction (AV:N/AC:L/PR:N/UI:N); account takeover yields full C/I/A impact within the app's unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 17, 2026 - 18:33 EUVD

Analysis Generated

Jul 17, 2026 - 17:16 vuln.today

CVE Published

Jul 17, 2026 - 16:39 cve.org

CRITICAL 9.8

DescriptionNVD

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass.

This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

AnalysisAI

Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected software is Vimesoft Inc.'s Enterprise Video Platform, a commercial video conferencing/streaming solution (CPE cpe:2.3:a:vimesoft_inc.:enterprise_video_platform). The root cause is CWE-620 (Unverified Password Change): a password-change or password-reset routine that sets a new password without validating the requester's identity - for example, not requiring the current password, a valid authenticated session, or a properly bound reset token. When that check is absent, the password-change endpoint itself becomes an authentication-bypass primitive, because whoever can reach it can overwrite a target account's credential and then log in as that user.

RemediationAI

Vendor-released patch: upgrade Enterprise Video Platform to version 3.25.0 or later, which is the first fixed release for the 3.11.0.0-3.24.x affected range. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0574 for vendor guidance. If immediate patching is not possible, restrict network reachability of the platform's password-change and password-reset endpoints - place the application behind a VPN or IP allowlist and add a WAF/reverse-proxy rule to block or authenticate requests to the account-recovery and change-password routes - accepting that this may break legitimate self-service password resets for remote users. As additional compensating measures, force password resets and invalidate active sessions for any accounts suspected of tampering, and monitor logs for anomalous password-change requests; these controls reduce exposure but do not remove the underlying flaw, so upgrading remains the primary fix.