How to fix or mitigate CVE-2026-4312?

24 hours: Identify all DrangSoft GCB/FCB instances in your environment and document current versions. 7 days: Upgrade all vulnerable instances to version 20260108 or later as provided by vendor. 30 days: Audit administrative account activity during the exposure period to identify and remove any unauthorized accounts; implement network segmentation to restrict API endpoint access.

GCB/FCB Audit Software CVE-2026-4312

Q: What is the CVSS score of CVE-2026-4312?

CVE-2026-4312 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

Q: Which versions of GCB/FCB Audit Software are affected by CVE-2026-4312?

DrangSoft GCB/FCB Audit Software versions prior to 20260108 contains a critical vulnerability allowing unauthenticated remote attackers to create administrative accounts and gain complete control of…. A patch is available.

EUVD-2026-12547 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-03-17 twcert

Authentication Bypass Gcb Fcb Audit Software

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 05, 2026 - 14:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 05, 2026 - 14:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 05, 2026 - 14:37 vuln.today

cvss_changed

CVSS changed

Jun 05, 2026 - 14:37 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Updated

Apr 16, 2026 - 05:50 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

20260108

EUVD ID Assigned

Mar 17, 2026 - 08:13 euvd

EUVD-2026-12547

Analysis Generated

Mar 17, 2026 - 08:13 vuln.today

CVE Published

Mar 17, 2026 - 07:29 nvd

CRITICAL 9.8

DescriptionCVE.org

GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account.

AnalysisAI

Unauthenticated administrative account creation in DrangSoft GCB/FCB Audit Software (versions prior to 20260108) allows remote attackers to invoke exposed APIs without authentication and provision new admin users, granting full control of the audit platform. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. Despite the trivial attack path, EPSS is currently low (0.13%, 32nd percentile) and no public exploit identified at time of analysis.

Technical ContextAI

GCB/FCB Audit Software is a Taiwan-market compliance/audit product from DrangSoft used to monitor controls under Taiwanese General Control Benchmark (GCB) / Financial Control Benchmark (FCB) frameworks. The flaw is classified as CWE-306 (Missing Authentication for Critical Function): one or more administrative API endpoints - including a user-creation endpoint - are reachable over the network without any session, token, or credential check. Per CPE cpe:2.3:a:drangsoft:gcb/fcb_audit_software:*, all versions of the product up to but not including the 20260108 build are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the API is reachable from the network with no preconditions, no required attacker training, and no user interaction.

RemediationAI

Vendor-released patch: build 20260108 or later - upgrade per the TWCERT advisory at https://www.twcert.org.tw/en/cp-139-10785-2cafe-2.html and the Traditional Chinese version at https://www.twcert.org.tw/tw/cp-132-10784-4f67d-1.html. Until the upgrade is applied, restrict the management interface to a dedicated administrative VLAN or jump host and block all inbound traffic to the audit server's HTTP/HTTPS API ports from general user networks and the internet at the firewall (this will break any agents or scheduled jobs that call those APIs from outside the management segment, so allow-list known internal collectors explicitly). As a detection-side compensating control, audit the application's existing user list for unexpected administrative accounts created before the upgrade window, since the vulnerability leaves no authentication trail by design.