CVE-2026-119746 ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119746?
CVE-2026-119746 is a high-severity vulnerability in ProSoft Technology ICX35-HWC-E, published on 4 Nov 2026.
Official description
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.
Which versions are affected by CVE-2026-119746?
How do I fix CVE-2026-119746?
No fix has been published for CVE-2026-119746 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119746 being exploited?
There is no known exploitation of CVE-2026-119746 in the wild and no public exploit code.
Sources
Also known as GHSA-g6fw-2m44-gprg.