CVE-2025-26326

A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do not have an additional authentication or computer verification mechanism. Tests indicate that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common sequences. This allows brute force attacks or trial-and-error attempts by malicious invaders. The vulnerability can be exploited by a remote attacker who knows or can guess the password used in the connection. As a result, the attacker gains complete access to the affected system and can execute commands, modify files, and compromise user security.

• CWE-287

• https://github.com/NVDARemote/NVDARemote
• https://github.com/azurejoga/CVE-2025-26326
• https://github.com/nvda-es/TeleNVDA
• https://nvda-addons.org/addon.php?id=270
• https://nvdaremote.com/
• https://www.nvaccess.org

Published

Feb 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-26312SendQuick Entera devices before 11HF5 are vulnerable to CAPT…5.3
• CVE-2025-26318hb.exe in TSplus Remote Access before 17.30 2024-10-30 allow…5.8
• CVE-2025-26319FlowiseAI Flowise v2.2.6 was discovered to contain an arbitr…9.8
• CVE-2025-2632Out of bounds write vulnerability due to improper bounds che…8.5
• CVE-2025-26320t0mer BroadlinkManager v5.9.1 was discovered to contain an O…6.5
• CVE-2025-26325ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataServic…9.8
• CVE-2025-2633Out of bounds read vulnerability due to improper bounds chec…7.8
• CVE-2025-26330Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, co…7
• CVE-2025-26331Dell ThinOS 2411 and prior, contains an Improper Neutralizat…7.8
• CVE-2025-26332TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2…5.5
• CVE-2025-26333Dell BSAFE Crypto-J generates an error message that includes…7.5
• CVE-2025-26335Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.…4.9