What is the CVSS score of CVE-2026-17070?

CVE-2026-17070 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Liman MYS are affected by CVE-2026-17070?

HAVELSAN Liman MYS versions 2.2.3-2.3.0 contain an authorization flaw that allows any authenticated user to escalate privileges and achieve complete compromise of managed infrastructure systems.. A patch is available.

How to fix or mitigate CVE-2026-17070?

Within 24 hours, identify all HAVELSAN Liman MYS instances running versions 2.2.3 through 2.3.0 and restrict administrative access exclusively to high-privilege administrators; immediately enable detailed audit logging and real-time monitoring for privilege escalation and unauthorized administrative operations. Within 7 days, conduct a full user access review on affected Liman instances, remove or restrict lower-privileged accounts from the platform where operationally feasible, and verify network segmentation controls isolate Liman MYS from untrusted network segments. Within 30 days, actively monitor HAVELSAN security advisories for patch availability; prepare a testing and deployment plan now so you can rapidly deploy patches to all affected systems within 48 hours of vendor release.

Liman MYS CVE-2026-17070

EUVD-2026-52685 HIGH

Missing Authorization (CWE-862)

2026-08-04 TR-CERT

GHSA-xppc-p674-7v8r

Authentication Bypass Liman Mys Havelsan Inc

8.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible panel requires low-privilege credentials (PR:L); missing ACL check yields full system impact; no scope change as compromise is contained to the managed host.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 04, 2026 - 15:01 EUVD

Analysis Generated

Aug 04, 2026 - 14:35 vuln.today

CVE Published

Aug 04, 2026 - 13:45 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Liman MYS: from 2.2.3 before 2.3.1.

AnalysisAI

Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authenticated user to access and invoke functionality that should be restricted to higher-privileged roles, resulting in full confidentiality, integrity, and availability compromise of the managed system. The flaw stems from CWE-862 - the application fails to enforce ACL checks before granting access to privileged operations, effectively allowing privilege escalation within the platform. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this straightforward to exploit by any authenticated user.

Technical ContextAI

Liman MYS is a server and infrastructure management panel developed by HAVELSAN Inc., a Turkish defense and information technology company. Based on the CPE string cpe:2.3:a:havelsan_inc.:liman_mys:*:*:*:*:*:*:*:*, this is an application-layer product. CWE-862 (Missing Authorization) describes a root cause where the software does not perform an authorization check when an actor attempts to access a resource or perform an action - distinct from authentication failure. Here, users are authenticated (CVSS PR:L confirms low-privilege credential requirement), but the application fails to verify whether their role has permission to execute specific ACL-restricted functionality. The 'Authentication Bypass' tag in the advisory is slightly imprecise; the correct characterization is authorization bypass or privilege escalation through missing ACL enforcement.

RemediationAI

Upgrade Liman MYS to version 2.3.1 or later, which resolves the missing authorization controls per the vendor advisory published at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0741. If immediate patching is not feasible, restrict access to the Liman MYS interface to a trusted internal network segment or VPN, preventing low-privilege external users from reaching the application entirely. Additionally, audit existing user accounts and reduce the number of accounts with any level of access to the platform, applying the principle of least privilege. Note that network-level isolation does not fix the underlying authorization flaw and should be treated as a temporary compensating control only.