What is the CVSS score of CVE-2026-1364?

CVE-2026-1364 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-1364?

Within 24 hours: Identify and inventory all IAQS and I6 instances in your environment and isolate them from untrusted networks immediately. Within 7 days: Implement network segmentation to restrict access to these systems, enable comprehensive logging/monitoring, and establish vendor contact for patch timeline. Within 30 days: Deploy compensating controls (WAF rules blocking unauthenticated admin requests, IP whitelisting, reverse proxy authentication), conduct full system audit for signs of compromise, and develop migration plan to patched or alternative solutions.

CVE-2026-1364

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-01-23 twcert@cert.org.tw

Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 09:15 nvd

CRITICAL 9.8

DescriptionCVE.org

IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities.

AnalysisAI

IAQS and I6 by JNC have a missing authentication vulnerability allowing unauthenticated remote attackers to directly access sensitive system functionality.

Technical ContextAI

Combined with CVE-2026-1363 (client-side enforcement), this CWE-306 missing authentication means the JNC systems have neither client-side nor server-side authentication on critical endpoints.