Skip to main content

Qualitysoft QND CVE-2026-81326

| EUVDEUVD-2026-80226 MEDIUM
Use of Hard-coded Cryptographic Key (CWE-321)
2026-09-16 jpcert GHSA-4xm4-3fr7-5qc7
Windows Information Disclosure Qnd Premium Qnd Standard Qnd Advance
6.8
CVSS 4.0 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Local-only attack requiring a logged-in Windows session; no integrity or availability impact; sole effect is credential confidentiality loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Metadata Corrected
Sep 16, 2026 - 08:40 vuln.today
tag: Windows added
Metadata Corrected
Sep 16, 2026 - 08:40 vuln.today
tag: Microsoft removed
Analysis Generated
Sep 16, 2026 - 08:29 vuln.today
CVSS changed
Sep 16, 2026 - 08:22 NVD
5.5 (MEDIUM) 6.8 (MEDIUM)
CVE Published
Sep 16, 2026 - 07:29 cve.org
MEDIUM 6.8

DescriptionCVE.org

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password.

AnalysisAI

Hard-coded cryptographic key exposure in Qualitysoft QND's Windows client allows any local authenticated user to decrypt and recover administrator credentials - including login ID and password - stored or processed by the PC management software. All three product lines (QND Advance, QND Premium, QND Standard) through their respective current versions are affected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must be logged in to a Windows PC on which the QND client software (Advance, Premium, or Standard edition, version at or below the affected thresholds) is installed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately captures the threat model: exploitation is strictly local, requires only a low-privilege Windows session, and yields high-confidence credential disclosure with no integrity or availability component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to the versions beyond the affected thresholds as directed by the Qualitysoft vendor advisory at https://www.qualitysoft.com/product/qnd_vulnerabilities_2026/: QND Advance should be updated beyond Ver.11.0.9i, and QND Premium and QND Standard beyond Ver.11.1i; exact fixed release identifiers are not independently confirmed from the available input and should be verified against the vendor page. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Windows

View all
CVE-2019-0803 HIGH POC
7.8 Apr 09

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM POC
5.5 Aug 17

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
CVE-2025-33053 HIGH POC
8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
CVE-2025-33073 HIGH POC
8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
CVE-2025-13315 CRITICAL POC
9.3 Nov 19

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
CVE-2013-10047 CRITICAL POC
9.3 Aug 01

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL POC
9.3 Aug 05

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
CVE-2025-34101 CRITICAL POC
9.3 Jul 10

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
CVE-2025-13316 HIGH POC
8.2 Nov 19

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
CVE-2025-34095 CRITICAL POC
9.3 Jul 10

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
CVE-2025-11953 CRITICAL POC
9.8 Nov 03

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
CVE-2025-24054 MEDIUM POC
6.5 Mar 11

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-321 – Use of Hard-coded Cryptographic Key

View all
CVE-2016-4437 CRITICAL POC
9.8
CVE-2025-30406 CRITICAL POC
9.0
CVE-2023-32077 HIGH POC
7.5
CVE-2025-13316 HIGH POC
8.2
CVE-2020-10884 HIGH POC
8.8
CVE-2025-57174 CRITICAL POC
9.8
CVE-2022-0664 CRITICAL POC
9.8
CVE-2025-59407 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-81326 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy