CVE-2026-24443: EventSentry < 6.0.1.20 Web Reports Unverified Password Change

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-24 · updated 2026-06-17
Weakness: CWE-620

Description

EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.

Affected products

NETIKUS.NET ltd EventSentry: before 6.0.1.20 — fixed in 6.0.1.20

How to fix

Upgrade to a fixed version: NETIKUS.NET ltd EventSentry 6.0.1.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-24443 or the next vulnerability affects your stack