CVE-2026-54801

HighCVSS 7.2

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) is caused by insufficient validation of authentication credentials during administrative account modifications via the web API. This allows an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.

Risk Assessment

The risk for the organization includes the possibility of administrative account takeover and privilege escalation, potentially leading to full system compromise, data theft, or disruption of critical infrastructure.

Recommendation

Immediately update CPCI85 systems to version V26.20 or later and SICORE Base to version V26.20.0 or later. Also review and strengthen authentication mechanisms in the web API.

Other vulnerabilities in CPCI85 Central Processing/Communication, SICORE Base

CVE-2026-54798Medium
A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) allows an authenticated attacker to exploit a debugging interface accessible via HTTP to crash the web process, causing denial of service (DoS).

Original NVD description (English source)

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.