What is the CVSS score of CVE-2026-2465?

CVE-2026-2465 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Turboard FOR-S are affected by CVE-2026-2465?

Turboard FOR-S versions 7.01.2026 through 17.02.2026 contain a critical privilege escalation vulnerability (CVE-2026-2465, CVSS 8.8) that allows unauthenticated attackers to gain administrative…. A patch is available.

How to fix or mitigate CVE-2026-2465?

Within 24 hours: Identify all Turboard FOR-S instances running versions 7.01.2026 through 17.02.2026 in your environment and isolate critical instances from external networks if immediately available. Within 7 days: Upgrade all affected Turboard FOR-S deployments to version 18.02.2026 or later; this is the vendor-released fix. Within 30 days: Conduct audit of administrative access logs for affected systems during the vulnerability window to detect unauthorized privilege escalation attempts, and verify successful patch deployment across all instances.

Turboard FOR-S CVE-2026-2465

EUVD-2026-29446 HIGH

Incorrect Authorization (CWE-863)

2026-05-12 TR-CERT

GHSA-vgx7-w2gw-273j

Authentication Bypass Privilege Escalation Turboard For S

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 12, 2026 - 12:02 EUVD

Analysis Generated

May 12, 2026 - 11:30 vuln.today

CVE Published

May 12, 2026 - 10:27 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.

This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.

AnalysisAI

Privilege escalation in Turboard FOR-S allows remote unauthenticated attackers to gain elevated access by exploiting incorrect authorization checks, requiring only user interaction. The vulnerability affects versions 7.01.2026 through 17.02.2026, with fix available in version 18.02.2026. Turkish national CERT (TR-CERT) reported this authorization bypass vulnerability (CWE-863), which enables attackers to compromise confidentiality, integrity, and availability of the affected business intelligence platform.

Technical ContextAI

This vulnerability stems from CWE-863 (Incorrect Authorization), indicating the application fails to properly verify user permissions before granting access to privileged functions or resources. Turboard FOR-S is a business intelligence and data visualization platform from Turkish vendor E-Kalite. The flaw allows attackers to bypass authorization controls and escalate privileges despite lacking proper credentials. The CVSS vector indicates network-accessible exploitation with low attack complexity but requiring user interaction (AV:N/AC:L/PR:N/UI:R), suggesting the attack likely involves social engineering to trick a legitimate user into triggering the authorization bypass, such as clicking a malicious link or opening a crafted document that exploits the authorization flaw.

RemediationAI

Upgrade Turboard FOR-S to version 18.02.2026 or later immediately, as confirmed by TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0224. If immediate patching is not feasible, implement compensating controls: restrict network access to Turboard FOR-S to trusted IP ranges via firewall rules (eliminates AV:N vector but impacts legitimate remote users), deploy web application firewall with rules to detect authorization bypass attempts (may generate false positives requiring tuning), enforce multi-factor authentication for all user accounts (does not prevent privilege escalation but limits initial access), and implement heightened security awareness training specifically warning users against clicking untrusted links to Turboard dashboards (reduces UI:R success rate but relies on human behavior). These workarounds provide defense-in-depth but do not eliminate the underlying authorization flaw - patching remains the only complete remediation.