CVE-2026-22234

Critical

Published: 08 January 2026

Published

08 January 2026

Modified

18 February 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0037 29.3th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-22234 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Opexustech Ecase Portal. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-22234 is a critical authorization bypass vulnerability (CWE-639) with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in OPEXUS eCasePortal versions before 9.0.45.0. The flaw enables unauthenticated attackers to access the Attachments.aspx endpoint and exploit predictable formid values to perform unauthorized operations on user-uploaded files.

Any unauthenticated attacker with network access can exploit this vulnerability by iterating through predictable formid parameters on the Attachments.aspx endpoint. Successful exploitation allows the attacker to download or delete all user-uploaded files across the system or upload arbitrary new files, compromising confidentiality, integrity, and availability.

Mitigation requires upgrading to OPEXUS eCasePortal version 9.0.45.0 or later. Further details on the vulnerability and remediation are provided in the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-02.json and the official CVE record at https://www.cve.org/CVERecord?id=CVE-2026-22234.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-1486

Vulnerability details

OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.

CWE(s): CWE-639

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Authorization bypass on public Attachments.aspx endpoint enables remote unauthenticated exploitation of a web application for file access/manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0