CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
Unauthenticated attackers can bypass password reset validation to take over administrator accounts in Integrics Enswitch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107640?
CVE-2026-107640 is a critical authentication bypass vulnerability in Integrics Enswitch, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.
Weakness: CWE-640
Which versions are affected by CVE-2026-107640?
How do I fix CVE-2026-107640?
No fix has been published for CVE-2026-107640 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-107640 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107640 exists.
Sources
Also known as GHSA-qxpp-mcfv-63xp.