How severe is CVE-2026-2406?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2026-2406 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Universe Software Computer Marketing Trade And Industry Inc. Online Registration Workflow Management System

CVE-2026-2406

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through 12022026.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.004 (29.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Universe Software Computer Marketing Trade And Industry Inc. Online Registration Workflow Management System — versions 0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

Public proof-of-concept exploits

References

iletisim@usom.gov.tr (government-resource)

Frequently asked questions

What is CVE-2026-2406?: CVE-2026-2406 is a medium-severity vulnerability in Universe Software Computer Marketing Trade And Industry Inc. Online Registration Workflow Management System, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-07-22.
How severe is CVE-2026-2406?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2026-2406 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.