What is the CVSS score of CVE-2026-14169?

CVE-2026-14169 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-14169?

Within 24 hours, identify all instances of the affected product in your environment and isolate them from untrusted networks while implementing strict access controls, such as multi-factor authentication and IP whitelisting. Over the next 7 days, enable detailed logging and alerting on authentication events to detect suspicious password changes or administrative lockouts, and monitor vendor advisories for any emerging exploit activity. Within 30 days, develop a mitigation strategy that may include transitioning to alternative products or applying vendor-supplied workarounds as they become available, and conduct a risk assessment to prioritize resource allocation.

CVE-2026-14169

EUVD-2026-49730 HIGH

Incorrect Behavior Order (CWE-696)

2026-07-28 info@cert.vde.com

GHSA-p3wp-7mgp-fwjp

Information Disclosure

8.1

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 28, 2026 - 10:01 EUVD

Analysis Generated

Jul 28, 2026 - 09:31 vuln.today

CVE Published

Jul 28, 2026 - 09:16 nvd

HIGH 8.1

DescriptionCVE.org

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.