{"id":"CVE-2026-88260","aliases":["EUVD-2026-75923","GHSA-46mh-97fq-r9vh"],"status":"published","title":"Authentication bypass using an alternate path or channel and Improper validation of syntactic...","description":"Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.\n\nThis issue affects Zenius EMS 8.0: through OAM (Build 109).","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00319,"percentile":0.25169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1286","CWE-288"],"published":"2026-09-11T02:29:52Z","modified":"2026-09-18T19:41:42Z","products":[{"vendor":"brainzcompany","product":"zenius ems 8.0"}],"references":[{"url":"https://www.brainz.co.kr/Features"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88260"},{"url":"https://github.com/advisories/GHSA-46mh-97fq-r9vh"}],"sources":{"cve":[{"id":"CVE-2026-88260","description":"Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.\n\nThis issue affects Zenius EMS 8.0: through OAM (Build 109).","status":"published","published":"2026-09-11T02:29:52.162Z","modified":"2026-09-11T16:53:14.457Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-288","CWE-1286"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-75923","description":"Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.\n\nThis issue affects Zenius EMS 8.0: through OAM (Build 109).","status":"published","published":"2026-09-11T02:29:52Z","modified":"2026-09-11T16:53:14Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:22.225258Z"}],"ghsa":[{"id":"GHSA-46mh-97fq-r9vh","title":"Authentication bypass using an alternate path or channel and Improper validation of syntactic...","description":"Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.\n\nThis issue affects Zenius EMS 8.0: through OAM (Build 109).","status":"published","published":"2026-09-11T03:30:24Z","modified":"2026-09-11T03:30:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:11:43.788148Z"}],"nvd":[{"id":"CVE-2026-88260","description":"Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.\n\nThis issue affects Zenius EMS 8.0: through OAM (Build 109).","status":"published","published":"2026-09-11T03:16:24.303Z","modified":"2026-09-18T19:41:42.593Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-288","CWE-1286"],"updated_at":"2026-11-02T14:12:46.271848Z"}]}}