CVE-2026-12571

CRITICAL9.8

Published 2026-08-11 · Source 0fc0942c-577d-436f-ae8e-945763c79b02

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-287CWE-640

Same severity, most recent

CVE-2026-71384
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
2026-08-11 · score 9.6
CVE-2026-70306
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
2026-08-11 · score 9.3
CVE-2026-65791
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
2026-08-11 · score 9.8
CVE-2026-62893
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
2026-08-11 · score 9.8
CVE-2026-62878
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
2026-08-11 · score 9.8