Cyber Resilience

CVE-2026-39349

Crypto Weakness in Orangehrm 5.0 – 5.8.1

Crypto Weakness
Published
07 April 2026
Modified
24 July 2026
Patch / advisory
View advisory
CVSS Score v4 2.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0011 2th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-39349 is a low-severity Inadequate Encryption Strength (CWE-326) vulnerability in Orangehrm Orangehrm. Its CVSS base score is 2.1 (Low).

Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This…

more

vulnerability is fixed in 5.8.1.

CWE(s)
CWE-326

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-66291Same product: Orangehrm Orangehrm
CVE-2025-66290Same product: Orangehrm Orangehrm
CVE-2026-39346Same product: Orangehrm Orangehrm
CVE-2026-39345Same product: Orangehrm Orangehrm
CVE-2025-66289Same product: Orangehrm Orangehrm
CVE-2024-36428Same product: Orangehrm Orangehrm
CVE-2026-39347Same product: Orangehrm Orangehrm
CVE-2026-39348Same product: Orangehrm Orangehrm
CVE-2025-66225Same product: Orangehrm Orangehrm
CVE-2025-44040Same product: Orangehrm Orangehrm

Affected Assets

orangehrm
orangehrm
5.0 — 5.8.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-13 Cryptographic Protection
  • SC-28 Protection of Information at Rest
  • CM-6 Configuration Settings
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V11.4.2
  • V14.1.2
  • V14.2.4

Mitigating Controls (NIST 800-53 r5) AI

SC-13 Cryptographic Protection good match
prevent

Directly requires use of approved cryptographic algorithms and modes (e.g., AES-GCM or CBC instead of ECB) for protecting sensitive data.

SC-28 Protection of Information at Rest good match
prevent

Mandates cryptographic protection of information at rest using sufficiently strong mechanisms, directly preventing pattern leakage from ECB-encrypted fields.

CM-6 Configuration Settings partial match
prevent

Enforces secure configuration settings that would prohibit selection of weak cipher modes such as ECB for stored sensitive data.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Strong encryption is required to protect confidentiality of data-at-rest.

PR.DS-02 mostly match
prevents

Strong encryption is required to protect confidentiality of data-in-transit.

PR.PS-01 partial match
prevents

Hardened baselines can enforce minimum cryptographic algorithm and key-length settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography partial match
prevents

Requiring the organization to define and enforce minimum cryptographic strength prevents deployment of insufficient key lengths or weak ciphers that can be brute-forced.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-326
Oracle Linux 9 (1 rule)
  • V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
RHEL 8 (1 rule)
  • V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
RHEL 9 (1 rule)
  • V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. via CWE-326
Windows Server 2016 (1 rule)
  • V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326
Windows Server 2019 (1 rule)
  • V-205727 Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326
Windows Server 2022 (1 rule)
  • V-254262 Windows Server 2022 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. via CWE-326

References