What is the CVSS score of CVE-2026-8377?

CVE-2026-8377 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Access Control System (GKS) are affected by CVE-2026-8377?

Armiya Access Control System (GKS) prior to Version 2 contains an authorization bypass enabling remote unauthenticated attackers to access sensitive operational data without credentials.

How to fix or mitigate CVE-2026-8377?

Within 24 hours: Identify all GKS deployments and confirm versions; assess network accessibility and prioritize systems exposed to untrusted networks or the public internet. Within 7 days: Implement network segmentation to restrict GKS access to trusted internal networks only; enable request-level logging and monitoring for unauthorized access patterns; document what sensitive data currently resides in GKS. Within 30 days: Establish subscription to Armiya security advisories; develop upgrade plan for GKS Version 2 once released; evaluate interim compensating controls for deployments that cannot be segmented.

Access Control System (GKS) CVE-2026-8377

EUVD-2026-42019 HIGH

Missing Authorization (CWE-862)

2026-07-07 TR-CERT

GHSA-37xf-hmm2-cg24

Authentication Bypass Access Control System Gks Armiya Information Technologies Ltd Co

8.2

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Missing authorization on network-reachable endpoints needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); primarily discloses data (C:H) with minor integrity effect (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 08:03 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Collect Data from Common Resource Locations.

This issue affects Access Control System (GKS): before Version 2.

AnalysisAI

Information disclosure in Armiya Information Technologies' Access Control System (GKS) before Version 2 allows remote unauthenticated attackers to collect sensitive data from common resource locations due to a missing authorization check. Because the affected endpoints do not verify that a requester is entitled to the data they return, an attacker who can reach the system over the network can harvest information without credentials. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS 8.2 rating and CWE-862 root cause make it a meaningful exposure for any accessible deployment.

Technical ContextAI

GKS is a physical/logical access control platform used to manage entry permissions and related identity resources; the CPE cpe:2.3:a:armiya_information_technologies_ltd._co.:access_control_system_(gks) identifies it as an application-layer product from a single Turkish vendor. The root cause is CWE-862 (Missing Authorization): the application performs an action or serves a resource without confirming the requester holds the required permissions. The vulnerability description phrase 'Collect Data from Common Resource Locations' indicates that shared or well-known resource paths (endpoints, files, or listing locations) are reachable without an authorization gate, so any client that knows or can guess those locations receives the underlying data. This is an access-control-logic failure rather than a memory-safety or injection issue, meaning the fix is enforcement of proper authorization on the exposed resources rather than input sanitization.

RemediationAI

Upgrade Access Control System (GKS) to Version 2 or later, which is the fixed release implied by the 'before Version 2' affected range; treat any build prior to Version 2 as vulnerable. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0502 for the exact patched build and vendor guidance before deploying. Until the upgrade is applied, reduce exposure by restricting network reachability of the GKS interface to trusted management networks or a VPN and blocking direct internet access to its endpoints, which sharply limits the unauthenticated network vector at the cost of remote administrative convenience; where feasible, place the affected 'common resource' endpoints behind an authenticating reverse proxy or WAF rule that denies unauthenticated requests, accepting that misconfigured allowlists could still leak paths. These are compensating controls only - the missing-authorization defect itself is fixed solely by upgrading to Version 2.