Jet Admin CVE-2026-75933

Exploitation requires an authenticated Jet Admin session with sufficient privileges to modify the sign-in page scripts and styles configuration. If this configuration access is restricted to workspace owners or super-admins, the attacker must first compromise such an account; if it is available to lower-privilege roles (PR:L per the CVSS vector), the barrier is lower. Once the payload is planted, victim exploitation requires only that a user visit the sign-in page (UI:P) - standard, expected behavior for all users. Exploitation is limited by: (1) the requirement for an authenticated session to plant the stored payload; (2) passive victim interaction in the form of a page visit; and (3) impact scoped to the Jet Admin application domain with no confirmed lateral movement to subsequent systems (SC:N/SI:N/SA:N in the CVSS 4.0 vector). The exact privilege level required to access sign-in page configuration is not confirmed from available data and should be validated against the vendor advisory.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) indicates a network-reachable, low-complexity attack requiring low-privilege authentication to plant the payload and passive user interaction (page visit) to trigger it. The high confidentiality and integrity scores reflect the ability to steal credentials or session tokens and to manipulate login-page content. The critical mitigating factor is PR:L: an attacker must first hold an authenticated session with privileges to modify sign-in page configuration, gating exploitation on account compromise or insider access. EPSS data was not available in the provided input and cannot be cited. No KEV listing and no public exploit code have been identified at time of analysis, meaning real-world exploitation probability is unconfirmed. Despite the authentication prerequisite for planting, the victim surface is broad - every user visiting the sign-in page - making this a meaningful risk for any organization where an attacker can obtain even a low-privilege Jet Admin account.

An attacker who holds a low-privilege authenticated Jet Admin account navigates to the sign-in page configuration and injects a JavaScript payload into the scripts field - for example, a credential-harvesting script that intercepts form submission or exfiltrates document.cookie to an attacker-controlled endpoint. The payload is stored server-side and silently executes in the browser of every user who subsequently visits the sign-in page, including administrators, enabling the attacker to escalate privileges or achieve full account takeover without further interaction. No public exploit code has been identified at time of analysis.