What is the CVSS score of CVE-2026-7187?

CVE-2026-7187 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

UKBS CVE-2026-7187

EUVD-2026-49769 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-28 iletisim@usom.gov.tr

GHSA-v5fv-jqvg-9pc9

Authentication Bypass

8.8

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent network access required, no authentication or user interaction, full impact on all CIA components.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 13:31 vuln.today

CVE Published

Jul 28, 2026 - 13:19 nvd

HIGH 8.8

DescriptionCVE.org

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported.

AnalysisAI

Missing authentication in Universal Software Inc. UKBS through version 28072026 allows adjacent network attackers to access restricted critical functionality without credentials, resulting in complete compromise of confidentiality, integrity, and availability. The vendor has confirmed the product is no longer supported, leaving all installations permanently vulnerable. No active exploitation or public exploit code has been reported.

Technical ContextAI

The vulnerability is classified as CWE-306: Missing Authentication for Critical Function, indicating that the UKBS application fails to verify user identity before granting access to sensitive operations. The product appears to be a proprietary software system from Universal Software Inc., with no further details available on its underlying technology stack. The missing authentication flaw permits unauthorized access to functionality that should be constrained by access control lists, effectively bypassing all intended security boundaries.

RemediationAI

No official patch is available because the vendor has discontinued support. As immediate compensating controls, organizations should isolate UKBS from all untrusted networks, restrict access to only explicitly authorized administrators via firewall rules or network segmentation, and monitor for anomalous access attempts. Block inbound connections to the UKBS service from adjacent network segments unless strictly necessary for business operations. Long term, decommission the product or replace it with a supported alternative. Note that isolation may disrupt legitimate workflows if UKBS is integrated with other systems; carefully assess dependencies before implementing restrictions.