What is the CVSS score of EUVD-2026-51109?

EUVD-2026-51109 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of FTC E-Commerce Panel are affected by EUVD-2026-51109?

FTC Software's E-Commerce Management Panel contains a critical flaw allowing unauthorized remote access to sensitive business data without requiring login credentials.. A patch is available.

How to fix or mitigate EUVD-2026-51109?

Within 24 hours, identify and inventory all systems running FTC E-Commerce Management Panel versions prior to 1.0.2, determine which systems are internet-facing, and immediately implement network segmentation or access restrictions to limit exposure. Within 7 days, deploy Web Application Firewall (WAF) rules to block unauthorized access patterns targeting critical functions, establish enhanced logging and monitoring on all affected systems to detect exploitation attempts, and document current access controls. Within 30 days, maintain continuous monitoring for FTC Software security advisories for patch availability; upon release of version 1.0.2, execute an emergency upgrade within 24 hours across all production and non-production systems.

FTC E-Commerce Panel EUVD-2026-51109

| CVE-2026-12722 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-30 TR-CERT

GHSA-pv5g-5934-fmr2

Authentication Bypass Ftc E Commerce Management Panel

8.2

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Missing authentication makes the critical function reachable remotely with no privileges (PR:N/AV:N/AC:L); impact is mainly data exposure (C:H) with limited modification (I:L) and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:50 vuln.today

CVE Published

Jul 30, 2026 - 13:16 cve.org

HIGH 8.2

DescriptionCVE.org

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass.

This issue affects FTC E-Commerce Management Panel: before 1.0.2.

AnalysisAI

Authentication bypass in FTC Software IT Services' FTC E-Commerce Management Panel before 1.0.2 lets remote unauthenticated attackers reach a critical function that is missing access controls (CWE-306), exposing sensitive data and permitting limited unauthorized modification. The CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), reflecting easy network exploitation with high confidentiality impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is a web-based e-commerce administration panel produced by the Turkish vendor FTC Software IT Services, identified by CPE cpe:2.3:a:ftc_software_it_services:ftc_e-commerce_management_panel. The root cause is CWE-306 (Missing Authentication for a Critical Function): a sensitive server-side function - typically an administrative or data-exposing endpoint of the panel - is reachable over the network without any authentication check being enforced. Rather than a credential-guessing or session-fixation flaw, the design simply omits the access-control gate on a privileged operation, so any client that knows or discovers the endpoint can invoke it directly.

RemediationAI

Vendor-released patch: 1.0.2 - upgrade FTC E-Commerce Management Panel to version 1.0.2 or later, which addresses the missing authentication check; consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0701 for vendor guidance. If immediate upgrade is not possible, restrict network access to the management panel by placing it behind a VPN or IP allowlist and blocking direct internet exposure of the administrative endpoints, accepting that this may inconvenience remote administrators. As an additional compensating control, front the panel with a reverse proxy or WAF that enforces authentication on the exposed critical function, noting this only mitigates the specific endpoint and does not fix the underlying design flaw.