What is the CVSS score of EUVD-2026-42033?

EUVD-2026-42033 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Liman MYS are affected by EUVD-2026-42033?

HAVELSAN Liman MYS, a management system deployed in Turkish government and critical infrastructure, contains a HIGH-severity authorization flaw (CVE-2026-11340) enabling authenticated low-privilege…

How to fix or mitigate EUVD-2026-42033?

Within 24 hours: Inventory all HAVELSAN Liman MYS instances and document current versions; audit low-privilege user accounts and revoke unnecessary access to sensitive operations; establish detailed logging on all administrative function calls. Within 7 days: Implement real-time monitoring for unauthorized privilege escalation attempts; contact HAVELSAN for Master.1107 patch release timeline and availability; prepare test environment for patch validation. Within 30 days: Deploy patch (Master.1107 or later) to all production instances; perform post-patch testing to confirm authorization controls properly restrict low-privilege users from administrative operations.

Liman MYS EUVD-2026-42033

| CVE-2026-11340 HIGH

Missing Authorization (CWE-862)

2026-07-07 TR-CERT

GHSA-6xf8-9p5r-2vcr

Authentication Bypass Liman Mys Havelsan Inc

8.3

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable panel exploitable by an authenticated low-privileged user (PR:L) with no UI; missing ACLs yield high integrity/availability impact and limited confidentiality exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 11:31 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Liman MYS: before release.Master.1107.

AnalysisAI

Privilege escalation and unauthorized functionality access in HAVELSAN Liman MYS (Yönetim Sistemi) before release.Master.1107 allows an authenticated low-privileged user to invoke functions that should be gated by access-control lists. Because certain endpoints fail to enforce authorization (CWE-862), a limited user can reach administrative or restricted operations, enabling significant integrity and availability impact. No public exploit identified at time of analysis; the flaw was reported by Turkey's national CERT (TR-CERT / USOM).

Technical ContextAI

Liman MYS is a web-based Linux server and system management platform developed by HAVELSAN Inc., a Turkish defense and IT contractor; it provides an extension-driven panel for administering servers, services, and users. The root cause is CWE-862 (Missing Authorization): the application authenticates the user session but does not consistently verify that the acting user is permitted to perform the requested action, so ACL checks are absent or incomplete on specific functionality. The single CPE cpe:2.3:a:havelsan_inc.:liman_mys:*:*:*:*:*:*:*:* covers all versions prior to the fixed build, and the 'Authentication Bypass' tag reflects that authorization boundaries - not credentials - are what get circumvented.

RemediationAI

Upgrade to Liman MYS release.Master.1107 or later, which is the vendor-fixed build per the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0504). Vendor-released patch: release.Master.1107. Until the upgrade is applied, reduce exposure by tightly restricting who holds accounts on the panel (the flaw requires an authenticated low-privileged user), reviewing and minimizing existing low-privilege accounts, and placing the Liman web interface behind a VPN or IP allowlist so it is not broadly network-reachable - with the trade-off that legitimate remote administrators must then connect through that restricted path. Monitor application and audit logs for low-privileged users invoking administrative endpoints or performing actions above their role as a detective control.