Futurum Authentication Module CVE-2026-14571

Per the description, exploitation requires only sending manipulated HTTP requests to the private area of Futurum Software's User Authentication Module - the supplied vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is needed, and the injection point is reachable because the WAF is incorrectly configured and can be bypassed. Limiting/qualifying factors: the attacker must reach the private-area endpoints over the network; the supplied CVSS 4.0 vector flags AT:P (a specific attack requirement is present), but the nature of that requirement is not described in the available sources and cannot be confirmed; exploitation also presumes the affected/misconfigured deployment of this specific module, whose fixed version is not stated in the inputs.

This is a genuine high-priority issue, not an inflated CVSS score. The signals align toward urgency: the vuln.today decision label is act_now, the vendor-supplied CVSS 4.0 base score is 9.1 with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) and high confidentiality impact extending to a subsequent system (VC:H, SC:H - consistent with data exfiltration from a back-end database). The weakness class (CWE-89, blind SQL injection) is well understood and historically highly exploitable. Counterbalancing this, several real-world signals are MISSING rather than negative: no EPSS probability was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present in the inputs - so exploitation status is 'no public exploit identified at time of analysis,' and the act_now label here is driven by severity and ease of exploitation, not by observed in-the-wild activity. One point of tension to verify: the CVSS 4.0 vector carries AT:P (an attack requirement is present), yet the description states the flaw can be triggered 'solely by sending manipulated HTTP requests,' which implies no special requirement - the nature of the AT:P requirement is not described in the available sources and should be confirmed with INCIBE/the vendor.

An unauthenticated attacker sends crafted HTTP requests to the private-area endpoints of Futurum Software's User Authentication Module, where unsanitised input reaches a database query and the misconfigured WAF fails to block the payload. Using blind SQL injection techniques, the attacker infers and extracts the full database schema and sensitive customer records, including PII. No public exploit code is identified at time of analysis, so an attacker would need to develop the injection payloads independently.