What’s Vulnerable › Vulnerabilities

CVE-2026-1433: uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure

• Severity: medium (CVSS 4.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-06 · updated 2026-10-25
• Weakness: CWE-522

Description

uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface (RUI). Exploitation requires administrative privileges and may disclose configuration data associated with SMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or uniFLOW Online are not affected.

Affected products

• NT-ware uniFLOW ULM (Universal Login Manager) Standalone: through 5.10

References

• https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/2026+Security+Advisory+ULM+Potential+Information+Disclosure
• https://www.canon-europe.com/psirt/advisory-information

Get alerted when CVE-2026-1433 or the next vulnerability affects your stack