What’s Vulnerable › Vulnerabilities
CVE-2026-86405: Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-09 · updated 2026-10-12
- Weakness: CWE-347
Description
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
Affected products
- Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1 — fixed in 26.9.1
How to fix
Upgrade to a fixed version: Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module 26.9.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86405 or the next vulnerability affects your stack