CVE-2026-60046highCWE-640

CVE-2026-60046: high-severity vulnerability in Helmholz myREX24V2

DoS via password reset

Published

Follow this CVE+ Monitor mbCONNECT24+ Monitor mymbCONNECT24

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
Helmholz · myREX24V2Helmholz · myREX24V2.virtualMB connect line · mbCONNECT24MB connect line · mymbCONNECT24
Related CVEs — Helmholz myREX24V2

In the same product, most dangerous first.

CVE-2021-34580HIGHRemote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0EPSS 1.0%CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2022-22520MEDIUMUser enumeration vulnerability in MB connect line and Helmholz productsEPSS 1.0%CVE-2021-34575HIGHInformation Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0EPSS 1.0%CVE-2026-14448HIGHAuthenticated RCE in system_certificates viewEPSS 0.9%CVE-2020-12528MEDIUMCVE-2020-12528EPSS 0.9%