CVE-2026-24443
Netikus Eventsentry ≤ 6.0.1.20
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-24443 is a high-severity Unverified Password Change (CWE-620) vulnerability in Netikus Eventsentry. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-11 (Re-authentication) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24443 is an unverified password change vulnerability affecting EventSentry versions prior to 6.0.1.20, specifically in the account management functionality of the Web Reports interface. The flaw stems from the password change mechanism not requiring validation of the current password, allowing a new password to be set without knowledge of the original credentials. It has been assigned a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-620.
An attacker who gains temporary access to any authenticated user session in the Web Reports interface can exploit this vulnerability to change the targeted account's password. This results in persistent account takeover, enabling ongoing unauthorized access. If the compromised account has administrative privileges, the attacker may achieve privilege escalation, potentially leading to full system compromise given the high confidentiality, integrity, and availability impacts.
Advisories recommend upgrading to EventSentry version 6.0.1.20 or later, as indicated in the vendor's version history at https://www.eventsentry.com/downloads/version-history. Additional details on the vulnerability and exploitation are available in the VulnCheck advisory at https://www.vulncheck.com/advisories/eventsentry-web-reports-unverified-password-change.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8560
Vulnerability Data
EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be…
more
set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Re-authentication explicitly requires users to prove identity before performing sensitive actions such as password changes.
Authenticator management requires identity verification during password distribution and changes, directly stopping unverified password updates.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure management of authentication information, directly addressing the need to verify the original password before allowing a change.
Mandates secure authentication mechanisms, which include verifying existing credentials before permitting password changes.
Identity management processes can incorporate verification steps, but the control itself does not explicitly require password-change verification.
Information access restriction can be strengthened by password verification, yet the control focuses on access rights rather than change procedures.