CVE-2026-50772
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An issue in Squirro Cognitive Search versions prior to 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload sent to the password reset function. The vulnerability can be exploited to take control of the application.
Risk Assessment
An attacker can exploit the password reset function to execute malicious code, potentially leading to data confidentiality breach or full system takeover.
Recommendation
Update Squirro Cognitive Search to version 3.14.2 or later. Additionally, secure the password reset function by implementing rate limiting and input validation.
Original NVD description (English source)
An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.