CVE-2026-2624

Critical

Published: 25 February 2026

Published

25 February 2026

Modified

26 February 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0263 85.8th percentile

Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2624 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Epati Antikor Next Generation Firewall. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and IA-2 (Identification and Authentication (Organizational Users)).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the authentication bypass vulnerability by requiring timely flaw remediation, such as upgrading Antikor NGFW to version 2.0.1301 or later.

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Explicitly identifies, justifies, and safeguards any critical functions permitting actions without identification or authentication, preventing CWE-306 missing authentication issues.

IA-2 Identification and Authentication (Organizational Users) good match

prevent

Mandates identification and authentication of users before accessing system resources, blocking remote authentication bypass exploitation on the NGFW.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authentication on a critical function of a public-facing NGFW directly enables remote exploitation of the management interface without credentials, matching T1190 for initial access and full device compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass.This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0.1298 before v.2.0.1301.

Deeper analysisAI

CVE-2026-2624 is a Missing Authentication for Critical Function vulnerability (CWE-306) in ePati Cyber Security Technologies Inc.'s Antikor Next Generation Firewall (NGFW). Published on 2026-02-25, it enables authentication bypass and affects versions from 2.0.1298 up to but not including 2.0.1301. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

Remote attackers with network access can exploit this vulnerability without privileges, authentication, user interaction, or high complexity. Successful exploitation allows full compromise of the affected NGFW, resulting in high impacts to confidentiality, integrity, and availability.

The USOM advisory at https://www.usom.gov.tr/bildirim/tr-26-0082 provides further details, with mitigation achieved by upgrading to Antikor NGFW version 2.0.1301 or later.