Which versions of Java are affected by CVE-2026-4219?

CVE-2026-4219 is a low-severity vulnerability in A flaw (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

Is there a public PoC exploit available for CVE-2026-4219?

Yes, a public proof-of-concept exploit is available for CVE-2026-4219. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4219?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Java CVE-2026-4219

Q: What is the CVSS score of CVE-2026-4219?

CVE-2026-4219 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12353 LOW

Use of Hard-coded Credentials (CWE-798)

2026-03-16 VulDB

Authentication Bypass Java Google Ywf Bpof Apgcs App

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 22, 2026 - 21:37 NVD

3.3 (LOW) 1.9 (LOW)

PoC Detected

Mar 16, 2026 - 16:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 07:00 euvd

EUVD-2026-12353

Analysis Generated

Mar 16, 2026 - 07:00 vuln.today

CVE Published

Mar 16, 2026 - 06:02 nvd

LOW 3.3

DescriptionCVE.org

A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown functionality of the file com/index/event/BuildConfig.java of the component ae.index.apgcs. Executing a manipulation of the argument ACCESS_KEY/HASH_KEY can lead to hard-coded credentials. The attack is restricted to local execution. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A hard-coded credentials vulnerability exists in the INDEX Conferences & Exhibitions Organization YWF BPOF APGCS Android application (versions up to 1.0.2) where attackers can manipulate ACCESS_KEY and HASH_KEY arguments in the BuildConfig.java component to extract embedded credentials. The vulnerability requires local execution on the device and grants only confidentiality impact (CWE-798: Use of Hard-Coded Credentials), but the existence of a published exploit and vendor non-responsiveness elevate practical risk despite the low CVSS score of 3.3.

Technical ContextAI

The vulnerability resides in the ae.index.apgcs Android application component, specifically within the com/index/event/BuildConfig.java file where cryptographic or authentication credentials are hard-coded directly into the application binary. This violates secure credential management principles and maps to CWE-798 (Use of Hard-Coded Credentials). Android applications compiled with hard-coded credentials are vulnerable to extraction via reverse engineering or local filesystem access. The BuildConfig pattern in Android typically stores compile-time configuration values; embedding sensitive credentials here makes them trivially recoverable by anyone with local device access or the ability to decompile the APK file. The affected product is identified through the package name ae.index.apgcs on Android platform.

RemediationAI

Unfortunately, no patch has been released by the vendor despite early disclosure attempts. Users should immediately uninstall the INDEX Conferences & Exhibitions Organization YWF BPOF APGCS application if they have installed it, or refrain from installing it until a patched version becomes available. If the app is essential, users should only install it on dedicated, non-shared devices without other sensitive applications, and restrict local access to the device by enabling device-level authentication (PIN/biometric). From a device perspective, apply the latest Android security patches to mitigate general local exploitation vectors. Consider reporting this unresponsive disclosure to relevant app store moderators (Google Play Store, etc.) to request removal or deprecation. Monitor the vendor's communication channels for eventual security updates, though timely resolution appears unlikely given the non-responsive stance.