CVE-2026-26721
Keystorage Global Facilities Management Software 20230721a
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-26721 is a high-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability in Keystorage Global Facilities Management Software. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-26721 is a vulnerability in Key Systems Inc Global Facilities Management Software version 20230721a, stemming from CWE-598. It enables a remote attacker to obtain sensitive information via the sid query parameter. The issue has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), highlighting high confidentiality impact, low attack complexity, no required privileges, and user interaction as a prerequisite.
Attackers can exploit this remotely by crafting malicious requests targeting the sid query parameter, typically tricking users into clicking links or visiting pages that trigger the disclosure. No authentication is needed, allowing unauthenticated remote exploitation that leaks sensitive data with limited integrity modification potential but no denial-of-service effects.
The key reference is https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2026-26721, a vulnerability disclosure repository that may detail proof-of-concept or further analysis, though no vendor advisories or patches are specified here. Security practitioners should review this source for mitigation steps and contact Key Systems Inc for official patches or workarounds.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7498
Vulnerability Data
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.5V14.2.1
Mitigating Controls (NIST 800-53 r5) AI
Requiring confidentiality and integrity protection for transmitted data reduces exposure of sensitive query parameters even though the control does not forbid placing secrets in URLs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.
HTTPS encryption protects query strings in transit but does not address the root design flaw of placing sensitive data in URLs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect sensitive data leakage via query strings.
DLP solutions can detect and block sensitive data in URLs.
Network security controls can enforce HTTPS and block sensitive data in URLs.
Application security requirements should mandate avoiding sensitive data in query strings.
Secure architecture principles discourage exposing sensitive data in URLs.
Secure coding standards directly prohibit placing secrets in query parameters.