Plaintext password storage in Crypttech Vatos DLP
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-256.
Summary
Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP from 1.1.176 before 1.1.243 stores a password in plaintext (CWE-256). A local user with low privileges can read the stored password and compromise confidentiality and integrity.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Crypttech Crypto and Informatics Technologies Industry and Trade Inc. | Vatos DLP | 1.1.176 to before 1.1.243 | 1.1.243 | Patch available | CNA |
- Vatos DLP VendorCrypttech Crypto and Informatics Technologies Industry and Trade Inc. Affected 1.1.176 to before 1.1.243 Fixed in 1.1.243 Patch available CNA
Remediation
Update Vatos DLP to version 1.1.243, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA Vatos DLP (Crypttech Crypto and Informatics Technologies Industry and Trade Inc.) Fixed in 1.1.243
Timeline
- 2026-10-30 Threatist record created from CVE-2026-86715
- 2026-10-30 Title updated · CNA
- 2026-10-30 Fix available: Crypttech Crypto and Informatics Technologies Industry and Trade Inc./Vatos [email protected] · CNA
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
- 2026-10-30 Alias added: GHSA-6686-9xqh-3wgv
References
Sources
- CVE-2026-86715 · CVE Program
- CVE-2026-86715 · NVD
- FIRST EPSS
- GHSA-6686-9xqh-3wgv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences