Read the docs
TI-2022-00961 Aliases CVE-2022-1065GHSA-gc8j-wq9j-m4cx

Multi Factor Authentication Bypass in various versions of Abacus ERP

Priority MEDIUM 43CWE-304Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.

Why it matters now

EPSS 0.02885 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Abacus ERP (Abacus Research AG): R1 of 2022-01-15, R4 of 2022-01-15, R6 of 2022-01-15 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Abacus Research AGAbacus ERPv2022 to before R1 of 2022-01-15; v2021 to before R4 of 2022-01-15; v2020 to before R6 of 2022-01-15; R5 (service pack) and later; R5 (service pack) and laterR1 of 2022-01-15, R4 of 2022-01-15, R6 of 2022-01-15, v2017Patch availableCNA
  • Abacus ERP VendorAbacus Research AG Affected v2022 to before R1 of 2022-01-15; v2021 to before R4 of 2022-01-15; v2020 to before R6 of 2022-01-15; R5 (service pack) and later; R5 (service pack) and later Fixed in R1 of 2022-01-15, R4 of 2022-01-15, R6 of 2022-01-15, v2017 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:abacus:abacus_erp_2018:*:*:*:*:*:*:*:*r7VulnerableAbacus
cpe:2.3:a:abacus:abacus_erp_2019:*:*:*:*:*:*:*:*r5VulnerableAbacus
cpe:2.3:a:abacus:abacus_erp_2020:*:*:*:*:*:*:*:*before r6VulnerableAbacus
cpe:2.3:a:abacus:abacus_erp_2021:*:*:*:*:*:*:*:*before r4VulnerableAbacus
cpe:2.3:a:abacus:abacus_erp_2022:*:*:*:*:*:*:*:*before r1VulnerableAbacus
  • cpe:2.3:a:abacus:abacus_erp_2018:*:*:*:*:*:*:*:* Versions r7 Vulnerable ·Abacus
  • cpe:2.3:a:abacus:abacus_erp_2019:*:*:*:*:*:*:*:* Versions r5 Vulnerable ·Abacus
  • cpe:2.3:a:abacus:abacus_erp_2020:*:*:*:*:*:*:*:* Versions before r6 Vulnerable ·Abacus
  • cpe:2.3:a:abacus:abacus_erp_2021:*:*:*:*:*:*:*:* Versions before r4 Vulnerable ·Abacus
  • cpe:2.3:a:abacus:abacus_erp_2022:*:*:*:*:*:*:*:* Versions before r1 Vulnerable ·Abacus

Remediation

  • Fix · CNA Abacus ERP (Abacus Research AG) Fixed in R1 of 2022-01-15, R4 of 2022-01-15, R6 of 2022-01-15, v2017

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1065
  2. 2026-10-03 Alias added: GHSA-gc8j-wq9j-m4cx

References

Exploit 1

  • TI-2025-00001 Authenticated arbitrary file read in Abacus CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences