Is CVE-2026-26368 actively exploited?

No active exploitation of CVE-2026-26368 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26368 be exploited remotely?

Yes. CVE-2026-26368 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26368?

CVE-2026-26368 has a CVSS score of 8.8 (HIGH) and an EPSS exploitation probability of 0.02%.

HOME VULNERABILITIESCVE-2026-26368

HIGH

CVE-2026-26368

CWE-862Published: February 15, 2026· Updated: Feb 18, 2026

8.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.6th

Official Description

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without supplying the current password or having sufficient privileges. By sending a crafted JSON-RPC request to /jsonrpc/management, an attacker can overwrite existing credentials, resulting in direct account takeover with full administrative access and persistent privilege escalation.

NVD Source

Technical Analysis

CVE-2026-26368 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.