Is there a public PoC exploit available for CVE-2026-5462?

Yes, a public proof-of-concept exploit is available for CVE-2026-5462. Prioritise patching immediately. EPSS: 0.0%.

Java CVE-2026-5462

Q: What is the CVSS score of CVE-2026-5462?

CVE-2026-5462 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18613 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

Java Information Disclosure Google Systm App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 07:45 euvd

EUVD-2026-18613

Analysis Generated

Apr 03, 2026 - 07:45 vuln.today

CVE Published

Apr 03, 2026 - 07:15 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was identified in Wahoo Fitness SYSTM App up to 7.2.1 on Android. Impacted is an unknown function of the file com/WahooFitness/SYSTM/BuildConfig.java of the component com.WahooFitness.SYSTM. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key . Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Wahoo Fitness SYSTM App on Android up to version 7.2.1 exposes a hard-coded cryptographic key (SEGMENT_WRITE_KEY) in the BuildConfig.java component, allowing local authenticated attackers to manipulate app arguments and potentially inject malicious data or alter user profiles. The vulnerability carries a CVSS score of 1.9 with low confidentiality impact, requires local access and authenticated privileges, and has publicly available exploit code; however, the vendor has not responded to early disclosure notifications.

Technical ContextAI

The vulnerability stems from use of hard-coded cryptographic keys (CWE-321) within the Android application's BuildConfig.java configuration file. The SEGMENT_WRITE_KEY parameter, which likely controls writes to the Segment analytics integration (a common mobile analytics platform), is embedded as a static credential in the compiled APK. This allows any local process with sufficient privileges to extract the key from the application binary, reverse-engineer the implementation, and forge authenticated requests to Segment's API or inject data into tracking streams. The affected product is identified by CPE cpe:2.3:a:wahoo_fitness:systm_app:*:*:*:*:*:*:*:*, and the root cause is insecure credential storage practices in the Java/Android codebase rather than using secure key management or environment-based configuration.

RemediationAI

No vendor-released patch identified at time of analysis; Wahoo Fitness has not responded to early disclosure notifications and no official advisory or patched version has been announced. Users should immediately upgrade to any version newer than 7.2.1 if available, though patch availability should be verified directly with Wahoo Fitness or via their official app store listing. As a workaround, users may restrict physical device access to trusted parties and monitor account activity for signs of unauthorized profile or analytics data manipulation. Security teams should consider disabling SYSTM App usage in high-security environments until an official patch is released and validated. For current information on patch availability, consult https://vuldb.com/vuln/355053 and direct contact with Wahoo Fitness support.