CVE-2026-24443 - Vulnerability Analysis

Overview

EventSentry < 6.0.1.20 contains a broken authentication vulnerability caused by lack of current password validation in the Web Reports account management, letting attackers with temporary authenticated sessions change passwords and escalate privileges.

Severity & Score

Impact

Attackers with temporary authenticated sessions can change passwords, enabling persistent account takeover and potential privilege escalation.

Mitigation

Update to version 6.0.1.20 or later.

References

• https://www.eventsentry.com/downloads/version-history
• https://www.vulncheck.com/advisories/eventsentry-web-reports-unverified-password-change

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner