CVE-2026-86405
Last modified
CVE-2026-86405 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Sipay Electronic Money and Payment Services Inc. | PrestaShop Virtual POS Module | >= 26.8.1, < 26.9.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-86405?
How severe is CVE-2026-86405?
How do I fix CVE-2026-86405?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-86397Dell PowerProtect Data Domain, Feature Release versions 7.7.…9.8
- CVE-2026-86398Dell PowerProtect Data Domain, Feature Release versions 7.7.…8.8
- CVE-2026-86399Dell PowerProtect Data Domain, Feature Release versions 7.7.…7.2
- CVE-2026-86400Dell PowerProtect Data Domain, Feature Release versions 7.7.…9.8
- CVE-2026-86401Dell PowerProtect Data Domain Management Center, Feature Rel…2.7
- CVE-2026-86404EAP's Artemis deserialization configuration permits deserial…8.8
- CVE-2026-86406The User Registration & Membership WordPress plugin before …7.5
- CVE-2026-86407The User Registration & Membership WordPress plugin before …3.7
- CVE-2026-86408Affected versions of MISP do not enforce parent-event visibi…6.5
- CVE-2026-86409Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable Sig…8.1
- CVE-2026-86410A flaw in the curl command line tool's logic makes it only s…8.1
- CVE-2026-86411An `ftp://` transfer configured with `CURLUSESSL_NONE` can r…9.1
Are you affected by CVE-2026-86405?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST