CVE-2026-22234

Critical

Published: 08 January 2026

Published

08 January 2026

Modified

18 February 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0005 14.7th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22234 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Opexustech Ecase Portal. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations to prevent unauthenticated access and manipulation of user-uploaded files via the Attachments.aspx endpoint.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of the authorization bypass flaw through patching to version 9.0.45.0 or later.

SI-10 Information Input Validation partial match

prevent

Validates the predictable formid input parameter to block unauthorized iteration and access to file operations.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Authorization bypass on public Attachments.aspx endpoint enables remote unauthenticated exploitation of a web application for file access/manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.

Deeper analysisAI

CVE-2026-22234 is a critical authorization bypass vulnerability (CWE-639) with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in OPEXUS eCasePortal versions before 9.0.45.0. The flaw enables unauthenticated attackers to access the Attachments.aspx endpoint and exploit predictable formid values to perform unauthorized operations on user-uploaded files.

Any unauthenticated attacker with network access can exploit this vulnerability by iterating through predictable formid parameters on the Attachments.aspx endpoint. Successful exploitation allows the attacker to download or delete all user-uploaded files across the system or upload arbitrary new files, compromising confidentiality, integrity, and availability.

Mitigation requires upgrading to OPEXUS eCasePortal version 9.0.45.0 or later. Further details on the vulnerability and remediation are provided in the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-02.json and the official CVE record at https://www.cve.org/CVERecord?id=CVE-2026-22234.