What is the CVSS score of CVE-2026-26721?

CVE-2026-26721 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Global Facilities Management Software are affected by CVE-2026-26721?

A high-severity vulnerability (CVSS 7.1) affects Global Facilities Management Software versions through 20230721a, with public exploits already available.

Is there a public PoC exploit available for CVE-2026-26721?

Yes, a public proof-of-concept exploit is available for CVE-2026-26721. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26721?

Within 24 hours: Inventory all instances of Global Facilities Management Software and identify affected versions; isolate critical instances from production networks if possible and enable enhanced logging. Within 7 days: Contact the vendor for patch timelines and interim guidance; implement network-based mitigations such as WAF rules or IP whitelisting for management interfaces; restrict user access to affected systems to essential personnel only. Within 30 days: Prepare for emergency patching upon vendor release; evaluate alternative solutions; conduct security assessment of affected systems for signs of compromise.

Global Facilities Management Software CVE-2026-26721

HIGH

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-02-20 cve@mitre.org

Information Disclosure Global Facilities Management Software

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 26, 2026 - 17:57 vuln.today

Public exploit code

CVE Published

Feb 20, 2026 - 17:25 nvd

HIGH 7.1

DescriptionCVE.org

An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.

AnalysisAI

Global Facilities Management Software versions up to 20230721a contains a security vulnerability (CVSS 7.1).

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious URL with sid parameter

Exploit

Send link to user requiring click

Execution

Browser executes request with user interaction

Impact

Sensitive information exposed in response