Cyber Resilience

CVE-2026-42514

High

Published: 29 April 2026

Published
29 April 2026
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0023 13.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-42514 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Org (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 13.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability details

This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs. Successful exploitation of this vulnerability could allow an attacker to impersonate…

more

the target user and gain unauthorized access to user accounts on the targeted system.

CWE(s)
CWE-319

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Plaintext OTP exposure in API responses directly enables network sniffing to capture credentials (T1040) for impersonation and unauthorized access using valid accounts (T1078).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24455Shared CWE-319
CVE-2025-67159Shared CWE-319
CVE-2025-13718Shared CWE-319
CVE-2026-30796Shared CWE-319
CVE-2024-36558Shared CWE-319
CVE-2026-30795Shared CWE-319
CVE-2026-23661Shared CWE-319
CVE-2025-70048Shared CWE-319
CVE-2025-1060Shared CWE-319
CVE-2025-0556Shared CWE-319

Affected Assets

Org
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-3 Role-based Training
addresses: CWE-319

Role-based training covers secure transmission methods, mitigating cleartext transmission of sensitive data.

CA-3 Information Exchange
addresses: CWE-319

By requiring documented security controls for information exchanges, the control reduces the risk of cleartext transmission of sensitive data.

CM-13 Data Action Mapping
addresses: CWE-319

Mapping transmission actions in data flows helps prevent cleartext transmission of sensitive information.

CM-6 Configuration Settings
addresses: CWE-319

Settings can enforce secure transmission protocols to prevent cleartext transmission of sensitive data.

MP-1 Policy and Procedures
addresses: CWE-319

Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information.

PM-17 Protecting Controlled Unclassified Information on External Systems
addresses: CWE-319

Enforces safeguards against cleartext transmission of CUI when data leaves organizational boundaries to external systems.

SA-9 External System Services
addresses: CWE-319

Explicit controls and continuous oversight on external system services prevent cleartext transmission of sensitive information over provider-managed channels.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-319

Key-establishment procedures specify secure distribution channels that preclude cleartext transmission of key material.

References