CSRF Attack on Backend Users of CERTVDE Products
CVE-2026-60041

5.3MEDIUM

Key Information:

Vendor: Mb Connect Line
Status: Mbconnect24; Mymbconnect24; Myrex24v2; Myrex24v2.virtual
Vendor: CVE Published:; 10 November 2026

🔔 Create Mb Connect Line Vulnerability Alert

What is CVE-2026-60041?

An unauthenticated remote attacker has the potential to exploit a Cross-Site Request Forgery (CSRF) vulnerability affecting CERTVDE software. This attack targets logged-in backend users, enabling the attacker to execute various critical system actions without proper authorization. As a result, the attacker could shut down the server or restore a previously uploaded backup, leading to significant risks such as data integrity loss and service availability disruption.

Affected Version(s)

mbCONNECT24 2.0.0 < 2.21.0

mymbCONNECT24 2.0.0 < 2.21.0

myREX24V2 2.0.0 < 2.21.0

References

https://www.certvde.com/en/advisories/VDE-2026-079/

https://www.certvde.com/en/advisories/VDE-2026-141/

CVSS V4

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Jul 8, 2026

Credit

SySS GmbH

CVE-2026-60041 Data

JSON