Is there a public PoC exploit available for EUVD-2026-18611?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18611. Prioritise patching immediately. EPSS: 0.0%.

Java EUVD-2026-18611

Q: What is the CVSS score of EUVD-2026-18611?

EUVD-2026-18611 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5458 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

Java Information Disclosure Google Individuals Pro App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 07:15 euvd

EUVD-2026-18611

Analysis Generated

Apr 03, 2026 - 07:15 vuln.today

CVE Published

Apr 03, 2026 - 07:00 nvd

LOW 1.9

DescriptionCVE.org

A weakness has been identified in Noelse Individuals & Pro App up to 2.1.7 on Android. This impacts an unknown function of the file com/reactnative/antelop/BuildConfig.java of the component com.afone.noelse. This manipulation of the argument SEGMENT_WRITE_KEY causes use of hard-coded cryptographic key . The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Noelse Individuals & Pro App for Android versions up to 2.1.7 uses a hard-coded cryptographic key (SEGMENT_WRITE_KEY) in the BuildConfig.java component, allowing local authenticated attackers to perform information disclosure and potential data injection attacks. The vulnerability requires local access and authenticated user privileges on the device, with publicly available exploit code demonstrating the attack. Despite early vendor notification, no patch or response has been provided.

Technical ContextAI

The vulnerability exists in the Android application's BuildConfig.java file within the com.afone.noelse component (CPE: cpe:2.3:a:noelse:individuals_&_pro_app:*:*:*:*:*:*:*:*), which exposes a hard-coded cryptographic key used for Segment analytics integration. CWE-321 (Use of Hard-Coded Cryptographic Key) represents the root cause-static credentials embedded in application code cannot be rotated and are extractable through reverse engineering or local file access. The Segment Write Key, when exposed, grants unauthorized write access to user analytics data and can be leveraged for profile manipulation and unauthorized data injection. This is a Java-based Android application vulnerability (tags: Java, Information Disclosure, Google).

RemediationAI

No vendor-released patch identified at time of analysis. The vendor (Noelse) was contacted early during responsible disclosure but did not respond with a remediation timeline or patched version. Users should immediately uninstall the application if they do not require its functionality, or contact Noelse support to request a patched release. Organizations deploying this app on managed mobile devices should restrict installation on multi-user or shared devices and implement application-level controls to prevent other authenticated users from accessing the application's local storage or data files. Monitor Noelse's official website and app store listings for version updates; a patched version should increment beyond 2.1.7. Until a vendor fix is available, consider alternative analytics solutions that do not embed static credentials. References: VulDB entry at https://vuldb.com/vuln/355046 and detailed exploit analysis at https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-afone-noel-3262de3f97fb80549986ddd8a160ed32.