Which versions of Tegalog are affected by CVE-2026-64940?

Tegalog (Fumy Otegaru Memo Logger) contains a critical authentication bypass in its management console, permitting remote unauthenticated attackers to gain full administrative access via a permissive…

How to fix or mitigate CVE-2026-64940?

Within 24 hours: implement firewall rules restricting network access to the Tegalog management console to known administrator IP addresses only; restrict all external access and require VPN tunneling if remote access is necessary. Within 7 days: conduct a forensic review of console access logs from the past 90 days to identify unauthorized sessions, and deploy real-time alerting on all management interface login attempts with automated incident notification. Within 30 days: contact Nishishi Factory to confirm patch availability timeline; if no patch is released within 60 days, initiate migration planning to a replacement memo logging solution with authenticated access controls and evaluate business continuity during transition.

Tegalog CVE-2026-64940

Q: What is the CVSS score of CVE-2026-64940?

CVE-2026-64940 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-55081 HIGH

Permissive Regular Expression (CWE-625)

2026-08-10 jpcert

GHSA-m4x6-wx7h-hwvh

Information Disclosure Tegalog Fumy Otegaru Memo Logger

8.8

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network login bypass sets PR:N and AV:N; integrity high from full console control; confidentiality and availability impacts are limited and scope is unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 08:22 NVD

8.6 (HIGH) 8.8 (HIGH)

Analysis Generated

Aug 10, 2026 - 08:01 vuln.today

CVE Published

Aug 10, 2026 - 07:09 cve.org

HIGH 8.6

DescriptionCVE.org

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from the management console.

AnalysisAI

Authentication bypass in Tegalog (Fumy Otegaru Memo Logger) by Nishishi Factory permits remote unauthenticated attackers to access the management console by exploiting a permissive regular expression (CWE-625) used during login validation. Once inside the console, an attacker can perform any operation the management interface exposes - including creating, modifying, or deleting memo log entries. No public exploit code has been identified at time of analysis, and the product is absent from CISA's Known Exploited Vulnerabilities catalog.

Technical ContextAI

Tegalog is a CGI-based memo logging application developed by Nishishi Factory, identified by CPE cpe:2.3:a:nishishi_factory:tegalog_-fumy_otegaru_memo_logger-:*:*:*:*:*:*:*:*. The root cause is CWE-625 (Permissive Regular Expression), a class of weakness in which a pattern used for input validation or authentication matching is broad enough to be satisfied by inputs the developer did not intend to permit. In this instance, the regex governing management console login can be matched by crafted input without supplying legitimate credentials, effectively nullifying the authentication gate. JPCERT/CC reported and coordinated disclosure, with a JVN advisory (JVN#99975039) published alongside a vendor security notice dated 2026-06-29.

RemediationAI

The primary remediation is to apply the vendor-released fix documented at https://www.nishishi.com/cgi/tegalog/info/notice20260629.shtml (published 2026-06-29), with the JVN advisory at https://jvn.jp/en/jp/JVN99975039/ providing supplementary disclosure details. A specific patched version number is not present in the available intelligence - consult the vendor notice directly to confirm the exact release to upgrade to. Until the patch is applied, operators should restrict network access to the Tegalog management console login endpoint: placing it behind IP allowlisting, a VPN gateway, or web-server-layer HTTP basic authentication are all viable compensating controls, though each introduces operational friction for legitimate administrators. Exposing the CGI endpoint directly to the Internet without any of these controls should be considered unacceptable given the unauthenticated exploitation path.