Back to overview

CVE-2026-22236

CRITICAL
10.0
CVSS 4.0
Description
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable APIs. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform.

Metadata

CVE ID
CVE-2026-22236
State
PUBLISHED
Assigner
MHV
Reserved
2026-01-06 23:20 UTC
Published
2026-01-14 14:34 UTC
Last updated
2026-01-14 15:01 UTC
Primary CWE
CWE-287
CWE-287 Improper Authentication
Vendor / Product
Bluspark Global / BLUVOYIX
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/RE:M/U:Red
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Bluspark Global BLUVOYIX — —
Weakness (CWE)
CWESourceDescription
CWE-287 cna CWE-287 Improper Authentication
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/RE:M/U:Red
References (1)
Back to overview