EUVD-2026-23692
GHSA-vqmj-h423-xx64
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authorization in EMQ EMQX Enterprise 6.0-6.1.0 allows authenticated remote attackers to trigger a denial-of-service condition via unspecified manipulation of the Session Handling component. CVSS 4.3 with attack vector AV:N/AC:L/PR:L reflects network-exploitable impact limited to availability; publicly available exploit code exists but active exploitation has not been confirmed by CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the EMQX Enterprise broker (PR:L in CVSS indicates 'low privilege' level credentials are sufficient-typically a standard user account rather than admin). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability presents low-to-moderate real-world risk despite network accessibility. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid EMQX Enterprise credentials (obtained via compromised user account, shared team access, or supply-chain relationship) authenticates to the broker and sends a specially crafted session manipulation request targeting the Session Handling component. The improper authorization flaw allows the attacker to trigger an unexpected state or resource exhaustion condition, causing the broker to become unresponsive to legitimate clients. … |
| Remediation | Upgrade EMQ EMQX Enterprise to a patched version released by EMQ post-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today