Team Password Manager CVE-2026-84699

Exploitation requires that the target user is a local account (the product's own authentication, as opposed to LDAP/AD-backed accounts) and that the attacker can reach the Team Password Manager web application's password-reset endpoint over the network. Per CVSS AV:N/AC:L/AT:N/PR:N/UI:N, no authentication, no user interaction, and no special attack requirement are needed against a reachable instance running a version before 14.184.308. The primary limiting factors are network reachability of the instance (an internet-exposed deployment is fully exposed; an internal-only/VPN-gated one is not) and the use of local accounts - installations that authenticate users exclusively via an external directory may not present the vulnerable local-reset path to the same degree.

This is a genuinely high-priority issue rather than an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H, score 9.3) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and high confidentiality and integrity impact - all consistent with the description of an unauthenticated reset yielding account takeover. Availability is rated none (VA:N), which fits: the attack grants access rather than causing outage. No EPSS score, KEV entry, or SSVC decision data was provided, so probability of exploitation cannot be quantified from the input; the absence of KEV means no confirmed active exploitation, and no POC is referenced. The dominant risk driver is the product's purpose - it is a credential store - so a takeover cascades into downstream secret disclosure. The signals (unauth network vector, low complexity, credential-vault target) align without contradiction; the main uncertainty is real-world exploitation likelihood, which is unmeasured here.

An attacker who can reach the Team Password Manager web interface over the network sends a crafted request to the local-account password-reset endpoint for a known or enumerated username, without authenticating. The server sets the attacker-chosen password because the identity-verification step is not enforced, and the attacker then logs in as that user and reads the shared vault entries visible to them. No public exploit code is referenced, but the low-complexity, no-interaction vector makes exploitation straightforward once the endpoint is reachable.