CVE-2026-4639

High

Published: 24 March 2026

Published

24 March 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0013 32.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4639 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Gss Vitalsesp. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access, directly preventing authenticated low-privilege attackers from performing unauthorized administrative functions.

AC-6 Least Privilege good match

prevent

Employs least privilege to ensure only authorized users can execute administrative actions, mitigating privilege escalation risks.

SI-2 Flaw Remediation good match

prevent

Identifies and corrects the specific incorrect authorization flaw through timely flaw remediation and patching.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Incorrect authorization flaw enables low-privileged authenticated remote attackers to escalate to administrative privileges through exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges.

Deeper analysisAI

CVE-2026-4639 is an Incorrect Authorization vulnerability (CWE-863) in Vitals ESP, a product developed by Galaxy Software Services. Published on 2026-03-24, it enables authenticated remote attackers to perform certain administrative functions, leading to privilege escalation. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

An attacker with low-level authenticated access over the network can exploit this flaw without user interaction. Successful exploitation allows the attacker to execute administrative actions beyond their intended privileges, potentially compromising the entire system by gaining unauthorized control over sensitive operations.

TWCERT advisories provide further details on the vulnerability, including mitigation recommendations, accessible at https://www.twcert.org.tw/en/cp-139-10795-25784-2.html and https://www.twcert.org.tw/tw/cp-132-10794-704a2-1.html. Security practitioners should consult these for specific patch information or workarounds from Galaxy Software Services.