CVE-2026-18771
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A missing authentication for critical function vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows authentication bypass and access to administrative functions without logging in.
Risk Assessment
An attacker can gain full access to the system without authentication, potentially leading to unauthorized changes, data theft, or disruption of operations.
Recommendation
Update Talassoft software to version V.16 or later, which includes a fix enforcing authentication for critical functions.
Other vulnerabilities in Talassoft Industrial Management Software
See all- CVE-2026-92085Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.
- CVE-2026-18931Critical
Use of Hard-coded Credentials vulnerability in Talassoft Industrial Management Software allows retrieval of embedded sensitive data. Affects versions from V.4 before V.16.
- CVE-2026-18780High
A Cross-Site Request Forgery (CSRF) vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows unauthorized actions to be performed on behalf of an authenticated user.
- CVE-2026-18630High
SQL injection vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. due to improper neutralization of special elements in SQL commands. Affects versions from V.4 before V.16.
Original NVD description (English source)
Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS