What is the CVSS score of EUVD-2026-39643?

EUVD-2026-39643 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Campus Recruiting are affected by EUVD-2026-39643?

Johnson & Johnson's Campus Recruiting application (versions prior to 2025-10-31 fix) contains an authorization vulnerability enabling remote attackers to access sensitive student recruitment data and…. A patch is available.

How to fix or mitigate EUVD-2026-39643?

Within 24 hours: Identify all affected application instances; assess scope of exposed data; prepare candidate notification strategy. Within 7 days: Deploy server-side authorization controls to replace client-side restrictions; implement network-level access controls; enable comprehensive access logging for forensic review. Within 30 days: Apply vendor patch once released; conduct full data exposure audit; execute regulatory notification as required by applicable privacy laws.

Campus Recruiting EUVD-2026-39643

| CVE-2026-57912 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-26 mitre

GHSA-q2wr-7pw7-p6fg

Information Disclosure Campus Recruiting

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable web app with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is pure data exposure, so C:H with I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 12:02 EUVD

Analysis Generated

Jun 26, 2026 - 11:20 vuln.today

DescriptionCVE.org

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers.

AnalysisAI

Information disclosure in Johnson & Johnson's Campus Recruiting web application (versions prior to the 2025-10-31 fix) allows remote unauthenticated attackers to view sensitive data submitted by recruited students as well as private notes interviewers entered about those candidates. The flaw stems from the server relying on client-side restrictions rather than enforcing authorization server-side (CWE-602). No CISA KEV listing or formal exploit code is published, though an independent security researcher (Eaton Works) documented the issue in a public write-up.

Technical ContextAI

The affected asset is a bespoke web-based campus/college recruiting platform operated by Johnson & Johnson (CPE: cpe:2.3:a:johnson_&_johnson:campus_recruiting:*). The root cause is CWE-602 (Client-Side Enforcement of Server-Side Security): the application appears to depend on the browser/front-end to gate access to candidate records, while the backend API serves the underlying data without performing equivalent server-side authorization checks. As a result, object/record access that should require proper authentication and authorization can be reached by directly manipulating requests, exposing student-supplied application data and confidential interviewer evaluation notes. The MITRE-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the data is reachable over the network with low complexity and no credentials.

RemediationAI

Patch available per vendor advisory: Johnson & Johnson is reported to have remediated the issue on/before 2025-10-31, so any current production instance of the hosted application should already incorporate the fix - confirm directly with J&J that your tenant/instance was patched. Because this is a vendor-operated web application rather than locally installed software, customers generally cannot self-patch; verification with the vendor is the primary action. If an unremediated instance must remain reachable, the effective compensating controls are server-side: enforce authorization on every API/record endpoint instead of trusting client-side checks (addresses CWE-602 directly), restrict the application to authenticated sessions, and place it behind network access controls (VPN/IP allowlisting) to reduce unauthenticated internet exposure - the trade-off being reduced accessibility for legitimate remote recruiters and candidates. The only public reference for technical details is https://eaton-works.com/2026/06/24/jnj-webapp-hacks/; no exact patched version string was provided to cite.