Agentic Ally CVE-2026-92546

Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no special preconditions are indicated - network-reachable, unauthenticated exploitation with no user interaction against the affected Agentic AI / Agentic Ally service. The description does not state any required feature flag, configuration mode, or protocol, and the exact mechanism that enables the identity spoofing is not described in the available sources. The principal limiting factor is product exposure and footprint: exploitation requires network reachability to a deployed, unpatched instance running a version before commit 0ef61f2e; this is a niche vendor product, so the exposed attack surface is narrow compared to mainstream software.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity authentication bypass (CWE-290, bypass by spoofing) requiring no privileges and no user interaction, with a high confidentiality impact but no stated integrity or availability impact. Decision signals are mixed-to-moderate: the vuln.today Decision label is 'this_week' (a real but non-emergency priority), and critically there is no EPSS score, no CISA KEV listing, and no public exploit or PoC reference in the provided data. So while the CVSS metrics portray an easy, unauthenticated remote attack, the exploitation-likelihood signals do not corroborate active or imminent mass exploitation - there is no public exploit identified at time of analysis. The absence of EPSS/KEV data means exploitation probability cannot be quantified from this input, not that it is zero. Net: this is a genuine, patch-worthy authentication-bypass issue warranting action within the week per the vendor/CERT framing, but on current evidence it is not a confirmed actively-exploited emergency; the C:H-only impact and niche product footprint temper the real-world urgency relative to the raw 7.5 score.

A remote attacker, without credentials or user interaction, sends a request that spoofs a trusted identity to the Agentic AI / Agentic Ally service and is accepted as authenticated, bypassing the authentication control (CWE-290). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C:H, the attacker can thereby read sensitive data the authentication was protecting. No public exploit code or PoC reference is provided, and the specific mechanism of the spoofing is not described in the available sources.