CVE-2026-1433

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1433", "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "state": "PUBLISHED", "assignerShortName": "Canon_EMEA", "dateReserved": "2026-01-26T12:49:23.159Z", "datePublished": "2026-07-06T08:12:49.571Z", "dateUpdated": "2026-07-06T18:54:02.174Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "shortName": "Canon_EMEA", "dateUpdated": "2026-07-06T08:12:49.571Z"}, "title": "uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Not applicable"}]}], "affected": [{"vendor": "NT-ware", "product": "uniFLOW ULM (Universal Login Manager) Standalone", "platforms": ["Web Application"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "5.10", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "uniFLOW Universal Login Manager (ULM) Standalone\ncontains an information disclosure vulnerability that may allow an\nauthenticated administrator to access sensitive configuration information\nthrough the ULM Remote User Interface (RUI). Exploitation requires\nadministrative privileges and may disclose configuration data associated with\nSMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or\nuniFLOW Online are not affected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "uniFLOW Universal Login Manager (ULM) Standalone\ncontains an information disclosure vulnerability that may allow an\nauthenticated administrator to access sensitive configuration information\nthrough the ULM Remote User Interface (RUI). Exploitation requires\nadministrative privileges and may disclose configuration data associated with\nSMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or\nuniFLOW Online are not affected."}]}], "tags": ["x_cemea", "x_nt_ware", "x_subsidiary"], "references": [{"url": "https://www.canon-europe.com/psirt/advisory-information", "tags": ["vendor-advisory"]}, {"url": "https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/2026+Security+Advisory+ULM+Potential+Information+Disclosure", "tags": ["vendor-advisory", "mitigation"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Sam Shepherd working with BAE Systems", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T18:53:50.994716Z", "id": "CVE-2026-1433", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:54:02.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1433", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T18:53:50.994716Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:53:57.223Z"}}], "cna": {"tags": ["x_cemea", "x_nt_ware", "x_subsidiary"], "title": "uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Sam Shepherd working with BAE Systems"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Not applicable"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NT-ware", "product": "uniFLOW ULM (Universal Login Manager) Standalone", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.10"}], "platforms": ["Web Application"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.canon-europe.com/psirt/advisory-information", "tags": ["vendor-advisory"]}, {"url": "https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/2026+Security+Advisory+ULM+Potential+Information+Disclosure", "tags": ["vendor-advisory", "mitigation"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "uniFLOW Universal Login Manager (ULM) Standalone\ncontains an information disclosure vulnerability that may allow an\nauthenticated administrator to access sensitive configuration information\nthrough the ULM Remote User Interface (RUI). Exploitation requires\nadministrative privileges and may disclose configuration data associated with\nSMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or\nuniFLOW Online are not affected.", "supportingMedia": [{"type": "text/html", "value": "uniFLOW Universal Login Manager (ULM) Standalone\ncontains an information disclosure vulnerability that may allow an\nauthenticated administrator to access sensitive configuration information\nthrough the ULM Remote User Interface (RUI). Exploitation requires\nadministrative privileges and may disclose configuration data associated with\nSMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or\nuniFLOW Online are not affected.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "shortName": "Canon_EMEA", "dateUpdated": "2026-07-06T08:12:49.571Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1433", "state": "PUBLISHED", "dateUpdated": "2026-07-06T18:54:02.174Z", "dateReserved": "2026-01-26T12:49:23.159Z", "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "datePublished": "2026-07-06T08:12:49.571Z", "assignerShortName": "Canon_EMEA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Web Application"], "product": "uniFLOW ULM (Universal Login Manager) Standalone", "vendor": "NT-ware", "versions": [{"lessThanOrEqual": "5.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "uniFLOW Universal Login Manager (ULM) Standalone\ncontains an information disclosure vulnerability that may allow an\nauthenticated administrator to access sensitive configuration information\nthrough the ULM Remote User Interface (RUI). Exploitation requires\nadministrative privileges and may disclose configuration data associated with\nSMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or\nuniFLOW Online are not affected."}, {"lang": "es", "value": "uniFLOW Universal Login Manager (ULM) Aut\u00f3nomo\ncontiene una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n que puede permitir a un\nadministrador autenticado acceder a informaci\u00f3n de configuraci\u00f3n sensible\na trav\u00e9s de la Interfaz de Usuario Remota (RUI) de ULM. La explotaci\u00f3n requiere\nprivilegios administrativos y puede revelar datos de configuraci\u00f3n asociados con\nintegraciones SMTP o LDAP. Las implementaciones de ULM conectadas a uniFLOW Server o\nuniFLOW Online no se ven afectadas."}], "id": "CVE-2026-1433", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1433", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T18:53:50.994716Z", "version": "2.0.3"}}]}, "published": "2026-07-06T09:16:34.877", "references": [{"source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "url": "https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/2026+Security+Advisory+ULM+Potential+Information+Disclosure"}, {"source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "url": "https://www.canon-europe.com/psirt/advisory-information"}], "sourceIdentifier": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["web_application"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "uniFLOW ULM (Universal Login Manager) Standalone", "source": "cna", "vendor": "NT-ware"}, "product": "uniflow_ulm_(universal_login_manager)_standalone", "vendor": "nt-ware"}], "created": "2026-07-06T17:15:16.087713+00:00", "updated": "2026-08-01T19:00:12.219292+00:00", "vendors": ["nt-ware", "nt-ware$PRODUCT$uniflow_ulm_(universal_login_manager)_standalone"]}