Authentication Bypass in Integrics Enswitch API
CVE-2026-107640

9.3CRITICAL

Key Information:

Vendor

Integrics

Status
Enswitch
Vendor
CVE Published:
8 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-107640?

Integrics Enswitch versions 3.13 through 4.4 are affected by an authentication bypass vulnerability that enables unauthenticated attackers to change account passwords. This issue arises from a flaw in the /api/json/user/password/update/ endpoint, allowing attackers to circumvent authentication by omitting the reset parameter. Attackers can exploit this vulnerability to target accounts without pending resets, taking advantage of the default empty reset_key. By enumerating valid usernames, they can potentially gain control over administrator accounts.

Affected Version(s)

Enswitch 3.13 <= 4.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-107640 - Proof of Concept

References

https://www.enablesecurity.com/advisories/ES2026-06-enswi...
third-party-advisoryexploit
https://www.integrics.com/enswitch/
product
https://www.vulncheck.com/advisories/integrics-enswitch-3...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enable Security
.