Monthly
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Remote, unauthenticated attackers can unlock Mitsubishi Electric's ICONICS GENESIS, GENESIS64, ICONICS Suite and related SCADA/HMI products by obtaining the system's challenge-response unlock value, which the vendor confirms is fixed and identical for every user and every installation, after which the attacker can disclose, tamper with, destroy or delete internal information or force the system into a denial-of-service condition. Affected builds are GENESIS 11.03 and prior, GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX 10.97.3 and prior, and MC Works64, GENESIS32 and BizViz at all versions. The vendor assigns CVSS 4.0 a 9.2 score, while our independent CVSS 3.1 assessment lands at 8.1 (AV:N/AC:H/PR:N/UI:N) because exploitation hinges on the one-time prerequisite of acquiring the static challenge response (the CVSS 4.0 AT:P attack requirement); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the risk driver is the universal reusability of a single leaked value rather than any observed campaign.
An authenticated administrator on Hitachi Vantara can retrieve password reset codes for arbitrary users through a privileged API, enabling takeover of other accounts on the application. This CWE-640 weakness is rated 7.4 High by CVSS 4.0 and requires high privileges (PR:H per the CVSS vector), so exploitation is confined to malicious insiders or attackers who already possess administrator access; device credentials and customer data remain inaccessible per the vendor. No public exploit identified at time of analysis.
Administrative account takeover in the Hitachi Vantara application is possible when password reset and email delivery are enabled, because reset-code attempts are not rate limited, allowing unauthenticated attackers to brute-force reset codes. The CVSS 4.0 score is 9.1 (Critical), but an independent assessment uses CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation depends on the reset flow being active and email configured; impact is bounded to application administration functions and does not expose device credentials or customer data. No public exploit code or CISA KEV entry was identified in the provided data.
Account takeover in Omnispace Agora Project before 26.10.0 is possible because the password-recovery feature mints reset tokens as the deterministic value sha1(login.password) instead of a random secret, so any party who knows or can guess a target's login and password pair can recompute a valid token and forge a reset request. The flaw is network-reachable and unauthenticated (CVSS 9.1, CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N, CWE-640) with high confidentiality and integrity impact, though the practical severity is tempered by the requirement to derive the credentials needed to compute the token, which is why the assessed AC is High. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released 26.10.0 as the fixed version.
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Unauthenticated account takeover in Portal del Hermano (Netherman, portaldelhermano.es) builds earlier than 2026-10-06 exploits the password-recovery endpoints POST /password/create-access and POST /password/email, which lack rate limiting and return distinct error messages acting as oracles for DNI, date of birth, phone number, and last four IBAN digits. An attacker can confirm the DNI, brute-force date of birth and IBAN digits, obtain the phone number via OSINT, and supply an attacker-controlled email to receive the password-reset link, achieving full takeover of any member account across all tenants, including profile data, full IBAN, and fiscal documents. No public exploit identified at time of analysis; disclosed CVSS 9.1 (CVSS 4.0) reflects high impact but high attack complexity (AC:H, PR:N, UI:N per independent assessment).
Password reset tokens in Traccar through 6.16.0 are not bound to their intended purpose, allowing an attacker who possesses a leaked reset link to obtain a full session via /api/session or change passwords via /api/password/update. Exploitation is unauthenticated but requires the attacker to first acquire a valid, unexpired reset token, for example through referer leakage, shared URLs, or intercepted email. No public exploit code has been identified at time of analysis.
Unauthenticated password reset bypass in Integrics Enswitch 3.13 through 4.4 allows remote attackers to change passwords for accounts that have no pending reset by omitting the reset parameter, causing the empty reset_key to match the defaulted empty value; this enables administrator account takeover after enumerating valid usernames. Publicly available exploit code exists, and the vulnerability is remotely exploitable without authentication or user interaction, making it a genuine high-priority issue.
Remote, unauthenticated account takeover is possible in MyRezzta (AKIN Software) versions 2.06.03 through 2.07.00 because the application's forgotten-password recovery mechanism is implemented weakly (CWE-640). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, an attacker who can reach the account-recovery endpoint needs no credentials, no user interaction, and no special configuration, and can gain high confidentiality and integrity impact - effectively seizing control of targeted user accounts - with no availability impact. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, but the flaw is rated 9.1 and was reported by TR-CERT; the practical risk is concentrated on internet-exposed MyRezzta deployments within the affected version range.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Remote, unauthenticated attackers can unlock Mitsubishi Electric's ICONICS GENESIS, GENESIS64, ICONICS Suite and related SCADA/HMI products by obtaining the system's challenge-response unlock value, which the vendor confirms is fixed and identical for every user and every installation, after which the attacker can disclose, tamper with, destroy or delete internal information or force the system into a denial-of-service condition. Affected builds are GENESIS 11.03 and prior, GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX 10.97.3 and prior, and MC Works64, GENESIS32 and BizViz at all versions. The vendor assigns CVSS 4.0 a 9.2 score, while our independent CVSS 3.1 assessment lands at 8.1 (AV:N/AC:H/PR:N/UI:N) because exploitation hinges on the one-time prerequisite of acquiring the static challenge response (the CVSS 4.0 AT:P attack requirement); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the risk driver is the universal reusability of a single leaked value rather than any observed campaign.
An authenticated administrator on Hitachi Vantara can retrieve password reset codes for arbitrary users through a privileged API, enabling takeover of other accounts on the application. This CWE-640 weakness is rated 7.4 High by CVSS 4.0 and requires high privileges (PR:H per the CVSS vector), so exploitation is confined to malicious insiders or attackers who already possess administrator access; device credentials and customer data remain inaccessible per the vendor. No public exploit identified at time of analysis.
Administrative account takeover in the Hitachi Vantara application is possible when password reset and email delivery are enabled, because reset-code attempts are not rate limited, allowing unauthenticated attackers to brute-force reset codes. The CVSS 4.0 score is 9.1 (Critical), but an independent assessment uses CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation depends on the reset flow being active and email configured; impact is bounded to application administration functions and does not expose device credentials or customer data. No public exploit code or CISA KEV entry was identified in the provided data.
Account takeover in Omnispace Agora Project before 26.10.0 is possible because the password-recovery feature mints reset tokens as the deterministic value sha1(login.password) instead of a random secret, so any party who knows or can guess a target's login and password pair can recompute a valid token and forge a reset request. The flaw is network-reachable and unauthenticated (CVSS 9.1, CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N, CWE-640) with high confidentiality and integrity impact, though the practical severity is tempered by the requirement to derive the credentials needed to compute the token, which is why the assessed AC is High. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released 26.10.0 as the fixed version.
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Unauthenticated account takeover in Portal del Hermano (Netherman, portaldelhermano.es) builds earlier than 2026-10-06 exploits the password-recovery endpoints POST /password/create-access and POST /password/email, which lack rate limiting and return distinct error messages acting as oracles for DNI, date of birth, phone number, and last four IBAN digits. An attacker can confirm the DNI, brute-force date of birth and IBAN digits, obtain the phone number via OSINT, and supply an attacker-controlled email to receive the password-reset link, achieving full takeover of any member account across all tenants, including profile data, full IBAN, and fiscal documents. No public exploit identified at time of analysis; disclosed CVSS 9.1 (CVSS 4.0) reflects high impact but high attack complexity (AC:H, PR:N, UI:N per independent assessment).
Password reset tokens in Traccar through 6.16.0 are not bound to their intended purpose, allowing an attacker who possesses a leaked reset link to obtain a full session via /api/session or change passwords via /api/password/update. Exploitation is unauthenticated but requires the attacker to first acquire a valid, unexpired reset token, for example through referer leakage, shared URLs, or intercepted email. No public exploit code has been identified at time of analysis.
Unauthenticated password reset bypass in Integrics Enswitch 3.13 through 4.4 allows remote attackers to change passwords for accounts that have no pending reset by omitting the reset parameter, causing the empty reset_key to match the defaulted empty value; this enables administrator account takeover after enumerating valid usernames. Publicly available exploit code exists, and the vulnerability is remotely exploitable without authentication or user interaction, making it a genuine high-priority issue.
Remote, unauthenticated account takeover is possible in MyRezzta (AKIN Software) versions 2.06.03 through 2.07.00 because the application's forgotten-password recovery mechanism is implemented weakly (CWE-640). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, an attacker who can reach the account-recovery endpoint needs no credentials, no user interaction, and no special configuration, and can gain high confidentiality and integrity impact - effectively seizing control of targeted user accounts - with no availability impact. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, but the flaw is rated 9.1 and was reported by TR-CERT; the practical risk is concentrated on internet-exposed MyRezzta deployments within the affected version range.