CVE-2026-2398

HighCVSS 8.8

Published: 10/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

A vulnerability in MobilMen 20T by Adam Retail Automation Ltd. allows authorization bypass through a user-controlled key, leading to privilege escalation. Affected versions are from v3 to 10072026. The vendor did not respond to the disclosure.

Risk Assessment

An attacker can exploit this vulnerability to gain unauthorized access to administrative functions, potentially leading to full system compromise and data breach.

Recommendation

Immediately isolate MobilMen 20T from the network and suspend its use until a patch is released. Implement additional access control mechanisms as a workaround.

Other vulnerabilities in MobilMen 20T

CVE-2026-2397Critical
An SQL injection vulnerability (CWE-89) has been found in MobilMen 20T by Adam Retail Automation Ltd. The flaw allows an attacker to manipulate database queries due to improper neutralization of special elements in SQL commands.

Original NVD description (English source)

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.