EUVD-2026-26070Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and low complexity, but PR:L required (authenticated attacker); scope unchanged; only availability impacted via reversible account lockout.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.
AnalysisAI
Account lockout abuse in Ercom Cryptobox allows any authenticated user to deny another user access by sending a specially crafted request that triggers the platform's lockout mechanism. Specific versions in the 4.37-4.40 range are confirmed affected per ENISA EUVD-2026-26070, and the vendor has released a patch. No active exploitation is confirmed - EPSS stands at 0.04% (13th percentile) and CISA SSVC marks exploitation status as none, placing this firmly in the category of a real but low-urgency availability risk.
Technical ContextAI
Cryptobox is Ercom's secure enterprise communication and file-sharing platform, widely adopted in European government and defense sectors. The vulnerability resides in the authentication account-lockout subsystem and is classified under CWE-694 (Use of Multiple Resources with Duplicate Identifier). This CWE suggests the lockout logic associates failed authentication attempts with a shared or externally controllable identifier rather than binding them strictly to the originating session or authenticated principal, enabling an attacker's requests to increment the lockout counter on a victim's account. The CPE cpe:2.3:a:ercom:cryptobox:*:*:*:*:*:*:*:* covers the Ercom Cryptobox application broadly, with EUVD narrowing the scope to specific version strings.
RemediationAI
A patch is available from the vendor per THA-PSIRT disclosure; administrators should consult Ercom's official documentation at https://info.cryptobox.com/doc/v4.40/4.40.en/ to identify the exact fixed version and apply the upgrade. An explicit patched version number is not independently confirmed from the available references - contact Ercom directly or verify the current release changelog before deploying. As a compensating control while patching, implement network-layer rate limiting or IP allowlisting on Cryptobox authentication endpoints to reduce an attacker's ability to send high volumes of lockout-triggering requests; note this does not prevent a legitimate insider from performing the attack manually with fewer requests. Enabling administrator alerting on abnormal failed-login patterns targeting individual accounts can help detect exploitation attempts early. Restricting account creation to reduce the pool of potential low-privileged attackers is an additional hardening measure in environments where that is operationally feasible.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today