Vulnerabilities 2026

Web security control bypass vulnerability (PDO26672)

First published: 19 August 2026

Last update: 19 August 2026

ID: PDO26672

Affected Components: Fabasoft Cloud

Severity: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, Base Score: 8.7 High

Status: Final

CVEs: -

Summary

A security vulnerability concerning a specific web security control feature of the Fabasoft Cloud has been identified.

Impact

Under certain circumstances this vulnerability allows the specific web security control feature to be bypassed. Consequently, an attacker could potentially trigger unauthorized actions within a user account.

Remediation

The affected feature is fixed.

Fabasoft Cloud

A hotfix was applied in the Fabasoft Cloud at 18. August 2026.

OpenSSL stack buffer overflow vulnerability (PDO23173)

First published: 13 March 2026

Last update: 13 March 2026

ID: PDO23173

Affected Components: Fabasoft Cloud

Severity: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Base Score: 9.8

Status: Final

CVEs: CVE-2025-15467

Summary

In the third-party library OpenSSL, a security vulnerability has been identified and classified as CVE-2025-15467 where maliciously crafted parameters can trigger a stack buffer overflow.

In particular circumstances an attacker may be able to exploit this vulnerability in the Fabasoft Cloud.

Impact

According to OpenSSL's information on this vulnerability the stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution.

Remediation

Fabasoft has updated the third-party library.

Fabasoft Cloud

A hotfix was applied in the Fabasoft Cloud at 5. February 2026.