CVE-2026-2624

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass.

This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0.1298 before v.2.0.1301.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Feb 25, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-262409.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif CVE-2026-262419.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif CVE-2026-262437.2A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2026-262448.8A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit th CVE-2026-262458.8A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit th CVE-2026-262464.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files CVE-2026-262479.1Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange wi CVE-2026-26255.5A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (R CVE-2026-26268.1The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthent CVE-2026-262639.8GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exi CVE-2026-262648.1BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WritePropert CVE-2026-262657.5Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory