CVE-2026-4639
Published: 24 March 2026
Summary
CVE-2026-4639 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Gss Vitalsesp. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-4639 is an Incorrect Authorization vulnerability (CWE-863) in Vitals ESP, a product developed by Galaxy Software Services. Published on 2026-03-24, it enables authenticated remote attackers to perform certain administrative functions, leading to privilege escalation. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
An attacker with low-level authenticated access over the network can exploit this flaw without user interaction. Successful exploitation allows the attacker to execute administrative actions beyond their intended privileges, potentially compromising the entire system by gaining unauthorized control over sensitive operations.
TWCERT advisories provide further details on the vulnerability, including mitigation recommendations, accessible at https://www.twcert.org.tw/en/cp-139-10795-25784-2.html and https://www.twcert.org.tw/tw/cp-132-10794-704a2-1.html. Security practitioners should consult these for specific patch information or workarounds from Galaxy Software Services.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14740
Vulnerability details
Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect authorization flaw enables low-privileged authenticated remote attackers to escalate to administrative privileges through exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly preventing authenticated low-privilege attackers from performing unauthorized administrative functions.
Employs least privilege to ensure only authorized users can execute administrative actions, mitigating privilege escalation risks.
Identifies and corrects the specific incorrect authorization flaw through timely flaw remediation and patching.