CVE-2026-27546

CVE-2026-27546 is a critical (CVSS 9.8) authentication bypass (CWE-288) in the _account_log function of the affected application, coordinated by CERT VDE; the specific vendor, product, and version range are not identified in the available data. An unauthenticated remote attacker can reach the vulnerable login routine over the network with low attack complexity, no privileges, and no user interaction, and is authenticated as an administrator even when accounts are properly configured. Full admin access yields the complete confidentiality, integrity, and availability impact reflected in the score, including reading and modifying data, changing application settings, and creating or altering accounts. Any deployment of the affected product is at risk, especially instances reachable from the internet; defenders should consult the CERT VDE advisory for the definitive product and version list. Exploitation has not been observed, the issue is not in CISA KEV, and no public proof-of-concept is known.

What to do: Because no fixed version or vendor is given in the available data, monitor the CERT VDE advisory feed (cert.vde.com) for CVE-2026-27546 and apply the vendor's patch as soon as the affected product is identified. Until patched, restrict network access to the application's login endpoint (allow-list, VPN, or reverse-proxy rule) and review authentication logs for successful admin logins from unexpected source IPs. If unauthorized admin activity is found, rotate all administrative credentials after patching.