Cyber Posture

CVE-2026-4639

High

Published: 24 March 2026

Published
24 March 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 32.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges.

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for logical access, directly preventing authenticated low-privilege attackers from performing unauthorized administrative functions.

AC-6 Least Privilege good match
prevent

Employs least privilege to ensure only authorized users can execute administrative actions, mitigating privilege escalation risks.

SI-2 Flaw Remediation good match
prevent

Identifies and corrects the specific incorrect authorization flaw through timely flaw remediation and patching.

Security SummaryAI

CVE-2026-4639 is an Incorrect Authorization vulnerability (CWE-863) in Vitals ESP, a product developed by Galaxy Software Services. Published on 2026-03-24, it enables authenticated remote attackers to perform certain administrative functions, leading to privilege escalation. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

An attacker with low-level authenticated access over the network can exploit this flaw without user interaction. Successful exploitation allows the attacker to execute administrative actions beyond their intended privileges, potentially compromising the entire system by gaining unauthorized control over sensitive operations.

TWCERT advisories provide further details on the vulnerability, including mitigation recommendations, accessible at https://www.twcert.org.tw/en/cp-139-10795-25784-2.html and https://www.twcert.org.tw/tw/cp-132-10794-704a2-1.html. Security practitioners should consult these for specific patch information or workarounds from Galaxy Software Services.

Details

CWE(s)
CWE-863

Affected Products

gss
vitalsesp
≤ 6.3

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Incorrect authorization flaw enables low-privileged authenticated remote attackers to escalate to administrative privileges through exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References