What is the CVSS score of CVE-2026-24356?

CVE-2026-24356 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Roxnor GetGenie are affected by CVE-2026-24356?

GetGenie versions through 4.3.0 contain a critical authorization flaw that could allow attackers to bypass access controls and gain unauthorized system access.

How to fix or mitigate CVE-2026-24356?

Within 24 hours: inventory all systems running GetGenie and isolate affected instances from production if possible; contact vendor for patch timeline and interim guidance. Within 7 days: implement network segmentation to restrict GetGenie access to trusted users only; apply compensating controls listed below; prepare rollback procedures. Within 30 days: deploy vendor patch immediately upon availability; conduct security audit of affected systems for signs of exploitation.

Roxnor GetGenie CVE-2026-24356

MEDIUM

Missing Authorization (CWE-862)

2026-01-22 audit@patchstack.com

Authentication Bypass

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 4.9 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetGenie: from n/a through <= 4.3.0.

AnalysisAI

Roxnor GetGenie versions up to 4.3.0 contain an authorization bypass vulnerability that allows authenticated users to exploit misconfigured access controls and gain unauthorized access to sensitive functionality. An attacker with low-level credentials can escalate privileges to perform confidential data theft, modify critical information, or disrupt service availability. No patch is currently available.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Roxnor GetGenie getgenie. Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetGenie: from n/a through <= 4.3.0.