What is CVE-2026-16971?

CVE-2026-16971 is a medium-severity vulnerability in Dfir-iris Iris-web, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.9/10. Published 2026-07-30.

How severe is CVE-2026-16971?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Resource exhaustion in Dfir-iris Iris-web

CVE-2026-16971

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Dfir-iris Iris-web — versions 2.4.26

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a (third-party-advisory)

Frequently asked questions

What is CVE-2026-16971?: CVE-2026-16971 is a medium-severity vulnerability in Dfir-iris Iris-web, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.9/10. Published 2026-07-30.
How severe is CVE-2026-16971?: Medium severity. CVSS v3 base score is 5.9 out of 10.