EUVD-2026-98359
GHSA-7chg-cp4g-f4v9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed service endpoint
-
DeliveryReach critical function over network
-
ExploitBypass absent authentication check
-
ExecutionExecute privileged operation
-
ImpactFull system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per CWE-306 and the AV:N/AC:L/PR:N/UI:N vector, exploitation would require only network reachability to the affected function of 'tbc' versions before 1.0, with no authentication and no user interaction against a default configuration. However, no specific feature, protocol, or configuration setting can be named because the CVE description is a placeholder and provides no concrete prerequisites - the only stated limiting factor is that fixed version 1.0 (or later) is not affected. This condition set is unverifiable until the vendor publishes real details. |
| Impact | Signals conflict sharply. The CVSS 4.0 base score is a maximal 10.0 with a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) and high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems - consistent with the CWE-306 (Missing Authentication for a Critical Function) classification and the 'Authentication Bypass' tag. However, the EPSS score is only 0.14% (3rd percentile), indicating very low modeled exploitation probability, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation. More fundamentally, the vulnerability description is a placeholder ('Vulnerability in tbc. This issue affects tbc: before 1.') and the product name 'tbc' ('to be confirmed') and CPE (cpe:2.3:a:tbc:tbc) appear to be stub/unpublished data rather than a real product, so the 10.0 score cannot be validated against any concrete technical detail. Treat this as a high-CVSS-but-unverifiable entry: do not prioritize remediation on the raw score alone until the vendor (references point to jtl-software.com) publishes a real description and affected-product identity. The low EPSS despite a perfect CVSS is itself a red flag that the scoring metadata and the real-world footprint are not yet reconciled. |
| Exploit ScenarioDerived | If the placeholder metadata reflects a genuine missing-authentication flaw, a remote attacker would reach a network-exposed, critical function of the affected product and invoke it without supplying any credentials, gaining full read/write control. No public proof-of-concept exists at time of analysis and no active exploitation is confirmed. The actual attack path cannot be described concretely because the CVE description contains no technical detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated network attackers may be able to reach and invoke critical functionality of 'tbc' releases prior to version 1.0 without supplying any credentials, a failure mode classified as missing authentication for a critical function (CWE-306); the unconstrained CVSS 4.0 score of 10.0 and our assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) both indicate complete loss of confidentiality, integrity and availability with a changed security scope. The practical caveat is significant: the CVE description is a placeholder that names no endpoint, protocol, or deployment configuration, so the exact preconditions remain unverifiable and our independent assessment explicitly records that the available signals conflict sharply. Exploitation pressure currently looks low - EPSS is just 0.14% (3rd percentile) and no public exploit has been identified at time of analysis - yet a vendor patch exists and ENISA/EUVD lists every release from 0 up to (but excluding) 1.0 as affected.
RemediationAI
Patch available per vendor advisory: upgrade 'tbc' to version 1.0 or later, which is the first release outside the EUVD-stated affected range (tbc 0 <1); because the vendor confirms a fix is available, applying it is the only fully reliable remediation and removes the CWE-306 authentication gap entirely. Until the upgrade is deployed, the exposed critical function has not been publicly identified, so compensating controls must be applied generically around network reachability: restrict access to the 'tbc' listening ports and management or API endpoints to trusted management networks only (via firewall rules, security groups, or a VPN), and front the service with an authenticating reverse proxy or gateway that enforces credentials before requests reach 'tbc' - the trade-off is added latency, extra operational complexity, and the risk of breaking legitimate integrations that currently rely on direct unauthenticated calls. Do not expose 'tbc' pre-1.0 to the internet or to untrusted segments, since the PR:N/UI:N nature of the flaw means a single network request is sufficient to attempt exploitation; consider temporarily disabling any non-essential functionality of 'tbc' while the fix is staged, accepting the loss of that functionality as the cost. Monitor logs for unauthenticated requests to critical 'tbc' endpoints and correlate them with the vendor advisory pages (https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310, https://nvd.nist.gov/vuln/detail/CVE-2026-89309, https://www.enisa.europa.eu) for concrete indicators once the vendor publishes technical details. Note that the vendor advisory also addresses CVE-2026-89310, so confirm the upgrade resolves both issues.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-306, Missing Authentication for Critical Function, meaning the affected code path is expected to enforce an authentication check before performing a security-relevant action but does not; with the assessed vector carrying PR:N and UI:N, exploitation would consist of a single network request to the unprotected function with no credentials and no victim interaction, against a default installation. The CPE string cpe:2.3:a:tbc:tbc:*:*:*:*:*:*:*:* identifies 'tbc' as both vendor and product and applies a wildcard to the version field, so the CPE alone does not bound the vulnerable range; the EUVD data narrows it to the range 0 < 1, i.e. every build below 1.0. No specific framework, daemon, protocol handler, or API surface can be named from the supplied intelligence because the underlying description is a stub, and the only technical constraints that can be asserted are the CWE class and the version boundary. The reference to jtl-software.com/de/cve-2026-89309-cve-2026-89310 indicates a vendor-side advisory pairing this identifier with a sibling CVE, which suggests the two issues may share a component or remediation.
Know when Tbc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE-306 missing authentication implies AV:N/AC:L/PR:N/UI:N; subsequent-system impact in the 4.0 input maps to S:C with full C/I/A loss.
Primary rating from Vendor (ENISA).
CVSS VectorVendor: ENISA
Lifecycle Timeline
4DescriptionCVE.org
Vulnerability in tbc.
This issue affects tbc: before 1.
Executive ViewAI
Every release of the 'tbc' product prior to version 1.0 exposes a critical function that an unauthenticated network attacker can reach, with a vendor-assessed worst case of complete loss of confidentiality, integrity, and availability across security boundaries. Although no public exploit has been identified at time of analysis and observed exploitation pressure is very low (EPSS 0.1%), the advisory is a placeholder that names no endpoint, protocol, or deployment configuration, so the real exposure is unquantified rather than low. Leadership should care because any internet-reachable pre-1.0 instance carries the full 10.0-rated impact, and the organization cannot yet confirm how many such instances exist.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB