What is the CVSS score of EUVD-2026-42959?

EUVD-2026-42959 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MobilMen 20T are affected by EUVD-2026-42959?

Adam Retail Automation's MobilMen 20T (v3 through build 10072026) contains a privilege escalation vulnerability (CVSS 8.8) that allows authenticated low-privilege users to access resources and…

How to fix or mitigate EUVD-2026-42959?

Within 24 hours: Inventory all MobilMen 20T deployments and identify which staff have low-privilege account access. Within 7 days: Restrict low-privilege account provisioning to essential personnel only, implement network segmentation for MobilMen 20T systems, enable audit logging on all privilege-escalation attempts, and escalate vendor contact through official support channels requesting emergency patch timeline. Within 30 days: If no patch timeline provided, evaluate alternative retail automation platforms and develop rollback procedures; consider disabling MobilMen 20T in non-critical environments pending vendor fix.

MobilMen 20T EUVD-2026-42959

| CVE-2026-2398 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 TR-CERT

GHSA-8jm8-xjp3-35hq

Authentication Bypass Privilege Escalation Mobilmen 20T

8.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable IDOR needing only a low-privileged account (PR:L) and no interaction; user-controlled key grants full cross-account read/write, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 17:34 vuln.today

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation.

This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Privilege escalation in Adam Retail Automation's MobilMen 20T (versions v3 through build 10072026) lets an authenticated low-privileged user manipulate a user-controlled key (CWE-639) to access resources or actions belonging to other, higher-privileged accounts. The flaw carries CVSS 8.8 and was reported by Turkey's national CERT (TR-CERT), but no public exploit identified at time of analysis and it is not in CISA KEV. The vendor was contacted but did not respond, so no coordinated fix is confirmed.

Technical ContextAI

MobilMen 20T is a mobile retail/sales-force automation product from the Turkish vendor Adam Retail Automation Ltd. (CPE cpe:2.3:a:adam_retail_automation_ltd.:mobilmen_20t). The root cause is CWE-639, Authorization Bypass Through User-Controlled Key - the classic Insecure Direct Object Reference (IDOR) pattern where the application uses a client-supplied identifier (such as a user ID, account ID, or object reference) to select the target of an operation without verifying that the authenticated caller is actually authorized for that object. Because authorization is keyed on attacker-controllable input rather than on the server-side session identity, changing that key lets one user act as another, and here that maps to privilege escalation across the application's role boundaries.

RemediationAI

No vendor-released patch identified at time of analysis, and the vendor did not respond to disclosure, so a fixed version cannot be cited. Consult the TR-CERT advisory (TR-26-0526, https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0526) and press Adam Retail Automation Ltd. directly for an updated build post-dating 10072026. As compensating controls: enforce server-side authorization checks at the network edge by placing MobilMen 20T behind an authenticating reverse proxy or WAF and adding request-level rules that reject object identifiers not owned by the session user; restrict the application to trusted networks/VPN so that a low-privileged account cannot be obtained by outside self-registration (trade-off: limits legitimate mobile field access); tighten account provisioning and disable any self-service registration to shrink the pool of low-privileged accounts that could abuse the flaw; and enable verbose access logging on requests carrying user/object identifiers to detect key tampering (trade-off: added log volume and no prevention, only detection).