Which versions of Java are affected by EUVD-2026-12339?

CVE-2026-4218 is a low-severity vulnerability in myAEDES App involving information exposure (CVSS 2.5).

Is there a public PoC exploit available for EUVD-2026-12339?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12339. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-12339?

During next maintenance window: Apply vendor patches when convenient. Verify information disclosure controls are in place.

Java EUVD-2026-12339

Q: What is the CVSS score of EUVD-2026-12339?

EUVD-2026-12339 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4218 LOW

Information Exposure (CWE-200)

2026-03-16 VulDB

Java Information Disclosure Google N A Myaedes App

1.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.0 (LOW) 1.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

2.5 (LOW) 2.0 (LOW)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 07:00 euvd

EUVD-2026-12339

Analysis Generated

Mar 16, 2026 - 07:00 vuln.today

CVE Published

Mar 16, 2026 - 05:32 nvd

LOW 2.5

DescriptionCVE.org

A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTH_KEY results in information disclosure. The attack is only possible with local access. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A local information disclosure vulnerability exists in myAEDES App versions up to 1.18.4 on Android, stemming from improper handling of the AUTH_KEY argument in the EngageBayUtils.java component. An authenticated local attacker with high complexity can manipulate this parameter to disclose sensitive information, though the attack requires local device access and significant technical effort. A public proof-of-concept exploit is now available, and the vendor has not responded to early disclosure attempts.

Technical ContextAI

The vulnerability resides in the aedes.me.beta package, specifically within the EngageBayUtils.java utility class responsible for EngageBay API interactions. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating inadequate access controls or validation on the AUTH_KEY parameter used for authentication to backend services. EngageBay is a customer engagement platform, and improper handling of authentication credentials in local utility functions can expose API keys or session tokens to other processes on the Android device, particularly if the application stores or processes these credentials without proper encryption or sandboxing. The affected product is identified as myAEDES App (CPE identifiers would be cpe:2.3:a:myaedes:myaedes_app:*:*:*:*:*:android:*:* with affected versions up to and including 1.18.4).

RemediationAI

Upgrade myAEDES App to a version newer than 1.18.4 if available from the vendor or app store. Until patches are released, mitigate risk by applying the following controls: restrict physical access to Android devices running the application, enable device-level encryption (full-disk or file-based), use strong device PIN/biometric locks to prevent unauthorized local access, and consider disabling the application if the AUTH_KEY compromise poses unacceptable risk to downstream EngageBay integrations. If the application is mission-critical, contact the vendor directly to request a security patch; alternatively, evaluate alternative applications with better vendor security practices. For enterprise deployments, implement mobile device management (MDM) policies to enforce these controls across all devices.