by Kastro
Paper/Archive/CVE-2026-32865

CVE-2026-32865

OPEXUS eComplaint — OPEXUS eComplaint and eCase insecure password reset

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 24.2.242 × 204.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.

Affected

ProductAffectedFixed inSource
eComplaint< 10.1.0.010.1.0.0CNA
eCASE< 10.1.0.010.1.0.0CNA

Scores by source

cisa-cg (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cisa-cg (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.jsonrefcve.org/CVERecord?id=CVE-2026-32865