Critical CVSS 9.6
CVE-2026-71384
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
What this means
- Exposure
- Exploitable from the adjacent network, without authentication and with no action from the victim.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- An authorisation check exists but its logic is wrong.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doPatch without waiting for the next scheduled cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.