CVE-2026-110475

criticalpriority · track · 0EPSS 0.005 · 41 %ile

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.48% (41st) EPSS

CVSS 9.3 · critical

Is it mine?

0 products

Check your exposure

Who says so?

— sources

EPSS · scored 2026-10-27

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.

cvss

Technical severity, 0–10. One row per scoring source.

9.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8–9.3

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · vdisclose@cert-in.org.in

v4.08highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1390USprimaryCWE-1390US

affected products

Products and version ranges known to be affected.

No affected products recorded.

sources

Which sources assert this record, and when.

NVD CVE.org MITRE

published 2026-10-26modified 2026-10-26

related (120)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-55040US	—OT critical	69.5% (99th)	KEV	2026-07-14
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96940US	high8.8	2.75% (86th)	Exploit	2026-10-02
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-93355US	high8.1	0.27% (20th)	Exploit	2026-09-28
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by explo…
CVE-2023-25367US	critical9.8	1.72% (77th)	—	2023-06-14
Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or web server.
CVE-2026-73025US	critical9.8	0.90% (60th)	—	2026-09-08
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.

+115 more

references (1) nvd

External citations — patches, advisories, analysis.

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan