CVE-2026-25654

A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.

• CWE-639

• https://cert-portal.siemens.com/productcert/html/ssa-605717.html

Published

Apr 14, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25648Versions of the Traccar open-source GPS tracking system star…8.7
• CVE-2026-25649Versions of the Traccar open-source GPS tracking system up t…8.7
• CVE-2026-2565A weakness has been identified in Wavlink WL-NU516U1 2025120…6.6
• CVE-2026-25650MCP Salesforce Connector is a Model Context Protocol (MCP) s…7.5
• CVE-2026-25651client-certificate-auth is middleware for Node.js implementi…6.1
• CVE-2026-25652is affected by an Incorrect Authorization vulnerability that…7.8
• CVE-2026-25655A vulnerability has been identified in SINEC NMS (All versio…8.5
• CVE-2026-25656A vulnerability has been identified in SINEC NMS (All versio…8.5
• CVE-2026-25657Ericsson Packet Core Gateway (PCG) versions prior to 1.30 co…6.5
• CVE-2026-25658Ericsson Packet Core Gateway (PCG) versions prior to 1.30 co…6.5
• CVE-2026-25659Ericsson Packet Core Gateway (PCG) versions prior to 1.30 co…6.5
• CVE-2026-2566A security vulnerability has been detected in Wavlink WL-NU5…7.3