TI-2026-05075 Aliases CVE-2026-5794 GHSA-f82c-vj6w-xx38

Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout

LOW 22CWE-694Published 2026-04-28 · Updated 2026-04-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00256 17th percentileScored 2026-11-07

Fix Fixed Cryptobox (Ercom): 4.40.175, 4.37.237

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ercom	Cryptobox	—	4.40.175, 4.37.237	Patch available	CNA

Cryptobox VendorErcom Affected — Fixed in 4.40.175, 4.37.237 Patch available CNA

Remediation

Fix · CNA Cryptobox (Ercom) Fixed in 4.40.175, 4.37.237

Timeline

2026-10-02 Threatist record created from CVE-2026-5794
2026-10-03 Alias added: GHSA-f82c-vj6w-xx38

References

Other 1

https://info.cryptobox.com/doc/v4.40/4.40.en/

TI-2026-00653 Privilege Elevation in Ercom Cryptobox administration console CVSS 4.0MEDIUM 4.8
TI-2025-13037 Cross-site request forgery in Ercom Cryptobox CVSS 4.0LOW 0.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences