JP1/AJS3 Manager CVE-2026-76936

The affected product is JP1/Automatic Job Management System 3 - Manager, versions 10-00 up to (but not including) 13-50-31; instances at or above 13-50-31 are not affected. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires only network reachability to the Manager service with no authentication and no user interaction. The available sources do not describe which interface, protocol, port, or input triggers the stack overflow, so the specific exploitation prerequisite beyond network reach to a vulnerable-version Manager cannot be stated from the evidence. Primary limiting factors: the target must run an affected version (10-00 ≤ v < 13-50-31) and be network-reachable by the attacker; applying the vendor update to 13-50-31 or later removes exposure.

Signals mostly align toward high priority but with one notable tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact and low availability impact, scored 9.4 (Critical). The vuln.today decision label is 'act_now', and a vendor patch is available, both reinforcing urgency. However, the EPSS probability is only 0.45% (39th percentile), which is low and indicates no significant observed or predicted exploitation activity at this time. There is no CISA KEV listing and no public exploit identified, so the high CVSS reflects theoretical severity and exposure rather than demonstrated in-the-wild use. In short: this is a genuine high-severity, high-exposure issue warranting prompt patching per the vendor and the act_now label, but current exploitation likelihood is low - treat as 'patch promptly because it is remotely exploitable and unauthenticated', not as 'under active attack'. Note also that the description is extremely sparse (only 'Stack-based Buffer Overflow'); the trigger and attack mechanism are not described in the available sources, so the network/unauthenticated characterization rests on the vendor-supplied CVSS vector rather than any mechanism detail.

An attacker with network access to a JP1/Automatic Job Management System 3 - Manager instance (version 10-00 up to but not including 13-50-31) sends crafted input that overflows a stack buffer. Per the CVSS vector this requires no authentication, no user interaction, and low attack complexity, yielding high confidentiality and integrity impact with limited availability effect. No public exploit code is identified at time of analysis, and the specific trigger is not described in the available sources.