What is the CVSS score of CVE-2026-12694?

CVE-2026-12694 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Enterprise Video Platform are affected by CVE-2026-12694?

Vimesoft Enterprise Video Platform versions 3.11.0.0 through 3.24.x are vulnerable to a critical remote authentication bypass that allows unauthenticated attackers to modify platform data and disrupt…. A patch is available.

How to fix or mitigate CVE-2026-12694?

Within 24 hours: inventory all Vimesoft deployments to identify affected versions (3.11.0.0-3.24.x); review platform audit logs for suspicious state-changing operations; restrict network access to the platform through firewall rules or network segmentation to minimize attack surface. Within 7 days: validate upgrade feasibility to version 3.25.0 or later in a staging environment and verify compatibility with integrated systems. Within 30 days: execute the upgrade across all production Vimesoft instances to version 3.25.0 or later and confirm full availability restoration.

Enterprise Video Platform CVE-2026-12694

EUVD-2026-45229 CRITICAL

Missing Authorization (CWE-862)

2026-07-17 iletisim@usom.gov.tr

GHSA-v7ww-6pvf-g5wc

Authentication Bypass

9.1

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Missing authorization on a network endpoint permits unauthenticated (PR:N), low-complexity state-changing calls affecting integrity and availability; no data disclosure, so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 17, 2026 - 19:18 EUVD

Analysis Generated

Jul 17, 2026 - 17:30 vuln.today

CVE Published

Jul 17, 2026 - 17:17 nvd

CRITICAL 9.1

DescriptionCVE.org

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

AnalysisAI

Improper access control in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) allows remote unauthenticated attackers to invoke privileged functionality that is not properly constrained by access control lists. Because the missing authorization check exposes state-changing operations, an attacker can modify or disrupt platform data and availability without credentials. This was reported by Turkey's national CSIRT (USOM); no public exploit has been identified at time of analysis and no EPSS or CISA KEV data is available.

Technical ContextAI

The affected product is an enterprise video conferencing/streaming platform developed by Vimesoft Inc. The root cause is CWE-862 (Missing Authorization): one or more server-side functions or endpoints fail to verify that the requesting principal is authorized to perform the action, so ACL enforcement is either absent or bypassable. The vendor and reporter classify this as an authentication/authorization bypass, meaning the application performs an operation on behalf of a request without confirming the caller holds the required role or ownership. No CPE string was provided in the input, so the exact affected component (API endpoint, admin function, or management interface) cannot be pinpointed beyond the version range.

RemediationAI

Upgrade Enterprise Video Platform to version 3.25.0 or later, which is the first release outside the affected range and therefore the vendor-released fixed version (Vendor-released patch: 3.25.0). Consult the USOM advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0574 and any Vimesoft release notes to confirm the exact patched build before deploying. If immediate patching is not possible, restrict network reachability to the platform's management and API endpoints using firewall rules or a reverse proxy that requires authenticated access, place the service behind a VPN, and monitor logs for unauthorized privileged calls; note that restricting endpoint access may interfere with legitimate remote users and federated integrations, so validate against normal usage before enforcing.