Read the docs
TI-2026-87006 Aliases CVE-2026-124575

Improper restriction of login attempts in SiteServer SSCMS admin login

Priority MEDIUM 43CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-307.

Summary

SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0 has improper restriction of excessive authentication attempts (CWE-307) in its Admin-Login CAPTCHA component. A remote attacker can abuse the weakness to make repeated login attempts, though the attack complexity is high and exploitation is assessed as difficult. No exploitation is reported.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Description from the CNA

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.

Why it matters now

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiteServerSSCMS7.0; 7.1; 7.1.0; 7.1.1; 7.1.2; 7.1.3; 7.2; 7.2.0; 7.2.1; 7.3; 7.4.0—No fix listedCNA
  • SSCMS VendorSiteServer Affected 7.0; 7.1; 7.1.0; 7.1.1; 7.1.2; 7.1.3; 7.2; 7.2.0; 7.2.1; 7.3; 7.4.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:sscms:sscms:*:*:*:*:*:*:*:*——Sscms
  • cpe:2.3:a:sscms:sscms:*:*:*:*:*:*:*:* Versions — — ·Sscms

Remediation

The sources list no fixed version for SiteServer SSCMS. The source advises applying the patch identified as df3becb.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Timeline

  1. 2026-11-09 Threatist record created from CVE-2026-124575

References

Patch 2

Other 1

  • TI-2026-06536 SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString CVSS 4.0HIGH 8.6
  • TI-2026-75444 SiteServer SSCMS authorization bypass exposes other sites' channels CVSS 4.0MEDIUM 5.1
  • TI-2026-06532 SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing CVSS 4.0LOW 2.1
  • TI-2019-08517 A issue was discovered in SiteServer CMS 6.9.0. CVSS 3.0HIGH 7.2
  • TI-2023-02682 SiteServer CMS search cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2026-56879 SiteServer SSCMS Agent Installation Workflow access control CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences