CVE-2026-35552

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-07-09
Weakness: CWE-862

Description

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

References

https://caxperts.com
https://github.com/caxperts/security-advisories/blob/main/2026/CAXSEC-2026-001_portal.md

Get alerted when CVE-2026-35552 or the next vulnerability affects your stack