Which versions of Newbee Mall are affected by CVE-2026-26219?

Newbee-mall uses cryptographically weak password storage (unsalted MD5) that exposes all user credentials to trivial offline cracking if the application database is compromised.

Is there a public PoC exploit available for CVE-2026-26219?

Yes, a public proof-of-concept exploit is available for CVE-2026-26219. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26219?

Within 24 hours, identify all newbee-mall deployments in use and audit database access logs and file integrity monitoring for breach indicators; prepare customer notification if unauthorized database access is confirmed. Within 7 days, implement mandatory user password resets across newbee-mall instances, deploy stronger password hashing (bcrypt with ≥12 rounds minimum or Argon2), and enable database encryption at rest and in transit. Within 30 days, maintain compensating controls permanently: implement strict database access controls, enable login anomaly detection and rate-limiting on failed attempts, enforce multi-factor authentication where supported, and establish continuous monitoring for bulk credential testing or mass login failures.

Newbee Mall CVE-2026-26219

Q: What is the CVSS score of CVE-2026-26219?

CVE-2026-26219 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-02-12 disclosure@vulncheck.com

Information Disclosure Newbee Mall Newbee Mall Project

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 16:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 16:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 25, 2026 - 16:40 vuln.today

Public exploit code

CVE Published

Feb 12, 2026 - 19:15 nvd

CRITICAL 9.1

DescriptionCVE.org

newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.

AnalysisAI

Weak password storage in newbee-mall exposes all user credentials to trivial offline recovery: the application hashes passwords with unsalted MD5 and no computational cost factor, so any attacker who obtains the hash table (via database dump, backup leak, or other compromise) can crack plaintext passwords en masse using rainbow tables or commodity GPU cracking. Publicly available exploit/disclosure material exists (VulnCheck advisory and upstream issue), but there is no public exploit identified as being used in active attacks, and EPSS is very low (0.02%, 3rd percentile). This is an enabling credential-disclosure weakness rather than a directly remotely triggerable RCE, and its real impact is contingent on a prior data exposure.