What is the CVSS score of CVE-2026-18362?

CVE-2026-18362 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

DFIR-IRIS Web CVE-2026-18362

EUVD-2026-51073 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-30 sba-research

GHSA-qx8j-r79q-xq3m

Denial Of Service Iris Web Dfir Iris

5.9

CVSS 3.1 · Vendor: sba-research

Severity by source

Vendor (sba-research) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

AC:L because the flaw removes the lockout barrier making unlimited attempts feasible; I:L and A:L reflect account takeover integrity risk and CWE-770 resource exhaustion respectively.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (sba-research).

CVSS VectorVendor: sba-research

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 10:21 vuln.today

DescriptionCVE.org

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.

AnalysisAI

Missing brute-force protection on the DFIR-IRIS web application's authentication endpoint exposes version 2.4.26 (and potentially earlier releases) to unlimited credential-stuffing and password-spraying attacks. Unauthenticated remote attackers can submit an unbounded number of login attempts without triggering rate limiting or account lockout, making weak or reused credentials trivially recoverable. DFIR-IRIS is an incident response platform handling sensitive case data, forensic artifacts, and investigation timelines - successful account compromise gives attackers direct access to that material. No public exploit has been identified at time of analysis, and KEV status is not confirmed.

Technical ContextAI

DFIR-IRIS (CPE: cpe:2.3:a:dfir-iris:iris-web) is an open-source collaborative DFIR case management platform built as a Python/Flask web application. The authentication endpoint lacks the resource-throttling controls classified under CWE-770 (Allocation of Resources Without Limits or Throttling): no per-IP rate limiting, no per-account lockout policy, and no CAPTCHA or exponential back-off mechanism are enforced. This class of flaw allows an adversary to submit credential pairs in bulk, bounded only by network bandwidth and the server's ability to process requests. The secondary 'Denial of Service' tag and CWE-770 classification further indicate that high-volume login floods can exhaust application or database connection resources, degrading service for legitimate users alongside the credential-theft risk.

RemediationAI

No vendor-released patched version has been independently confirmed from available data - consult the upstream dfir-iris repository and the sba-research advisory at https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260128-02_DFIR-IRIS_Missing_Brute_Force_Protection for patch status updates. As compensating controls pending a patch: place a reverse proxy (nginx, Caddy, or a WAF) in front of the IRIS login endpoint and enforce per-IP rate limiting (e.g., max 10 requests/minute to /login or equivalent), accepting a trade-off of potential legitimate-user lockout during IP collisions. Enable fail2ban or equivalent host-based tooling to block IPs exceeding authentication failure thresholds. Restrict network access to the IRIS web interface to internal/VPN-only egress to reduce the external attack surface - this is the most effective single mitigation given AV:N. Enforce strong, unique passwords and enable MFA if supported by the application. Monitor authentication logs for high-frequency failure bursts as a detection control.