What is the CVSS score of CVE-2026-8285?

CVE-2026-8285 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

FlexCity CVE-2026-8285

EUVD-2026-46187 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-07-21 TR-CERT

GHSA-m9cr-mcrx-m4w3

Information Disclosure Flexcity

4.3

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.4 MEDIUM

PR:L retained per CVSS; C:L added over provided C:N to reflect probable information disclosure (username enumeration) flagged by the vendor tag.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 13:16 vuln.today

DescriptionCVE.org

Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.

This issue affects FlexCity: from 5.536.0 through 11052026.

AnalysisAI

FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

CWE-307 (Improper Restriction of Excessive Authentication Attempts) describes a missing or ineffective rate-limiting or account-lockout mechanism on authentication surfaces, enabling brute-force attempts or server-side resource exhaustion through repeated credential submissions. The 'Excessive Allocation' consequence here indicates that each unthrottled attempt can consume server resources-session handles, memory, or connection pool slots-without bound. The CPE string (cpe:2.3:a:universal_software_inc.:flexcity:*:*:*:*:*:*:*:*) identifies Universal Software Inc.'s FlexCity, a city-management or smart-city platform, as the affected application. The vendor-assigned 'Information Disclosure' tag suggests the authentication endpoint may also return differential responses (distinct error messages or timing differences) that permit username or account-existence enumeration, a commonly co-occurring weakness with CWE-307 that the C:N CVSS metric does not reflect.

RemediationAI

Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0593 for vendor patch guidance-no exact fixed version number is present in the available data, so patch availability must be confirmed directly with Universal Software Inc. before upgrading. As an immediate compensating control, enforce request-rate limits at the reverse proxy or WAF layer in front of FlexCity authentication endpoints, capping attempts per account or per source IP per time window; note that IP-based throttling can be circumvented by distributed sources and should be combined with per-account lockout. Account lockout policies configured at the application or identity-provider level provide the strongest control, though lockout thresholds set too aggressively can themselves become a denial-of-service vector against legitimate users-balance with alert-only modes or CAPTCHA challenges. If the information-disclosure behavior (username enumeration) is confirmed, standardize all authentication error responses to a single generic message and equalize response timing to eliminate oracle conditions. Where operationally feasible, restrict access to the FlexCity authentication endpoint to trusted IP ranges or VPN egress points to reduce the exposed attack surface.