Cyber Resilience

CVE-2026-4320

Critical

Published: 18 May 2026

Published
18 May 2026
Modified
18 May 2026
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0025 16.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-4320 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Incibe (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability details

Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the…

more

need for credentials.

CWE(s)
CWE-288

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Authorization bypass via HTTP redirect manipulation directly enables remote exploitation of a public-facing web app (T1190) and leads to unauthorized privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Incibe
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-17 Remote Access
addresses: CWE-288

Authorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.

AC-9 Previous Logon Notification
addresses: CWE-288

Users can identify logons via alternate paths or channels by reviewing the previous logon time.

IA-10 Adaptive Authentication
addresses: CWE-288

Adaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.

IA-13 Identity Providers and Authorization Servers
addresses: CWE-288

Centralized IdPs close alternate authentication paths that enable bypass.

IA-8 Identification and Authentication (Non-organizational Users)
addresses: CWE-288

Enforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.

SC-11 Trusted Path
addresses: CWE-288

Requires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.

References