CVE-2026-35552

CVSS 8.1 HIGHEPSS 0.3%CWE-862

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

08 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

n/a · n/a

References

https://caxperts.com https://github.com/caxperts/security-advisories/blob/main/2026/CAXSEC-2026-001_portal.md