CVE-2026-12722: authentication bypass

CISO Take

This CVE describes a missing authentication check on a critical function in the FTC E-Commerce Management Panel, allowing any unauthenticated network attacker to reach privileged functionality directly (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). There is no EPSS score published, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code or Nuclei scanning template currently exists, so active mass exploitation has not been observed as of this writing. That said, the attack requires zero privileges and zero user interaction over the network, which is the profile of vulnerabilities that get weaponized quickly once a proof-of-concept surfaces. Note that this product's link to AI/ML is not established by the available description — it reads as a generic e-commerce administration panel, and the 'ml_ui' categorization here should be treated with low confidence until the vendor documentation confirms an AI-adjacent use case. Regardless of AI relevance, patch to version 1.0.2 or later immediately, and in the interim restrict network access to the management panel (VPN/allowlist) and monitor for unauthenticated requests to admin endpoints.

Sources: NVD CISA KEV ATLAS

What is the risk?

Base severity is high (CVSS 8.2) driven by a fully network-exploitable, zero-privilege, zero-interaction authentication bypass with high confidentiality impact. However, real-world exploitation likelihood is currently unconfirmed: no EPSS score is available, the CVE is not in CISA KEV, and there is no public exploit or scanner template. Actual organizational risk therefore depends heavily on whether the panel is internet-exposed. Given CWE-306 (missing authentication for critical function) is a well-understood, easy-to-automate weakness class, risk should be treated as high for any internet-facing deployment until patched.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated HTTP request directly to the panel's critical function endpoint over the network.

AML.T0049

Exploitation

Missing authentication check (CWE-306) allows the request to execute as if from a privileged admin session.

Impact

Attacker gains unauthorized access to confidential data or configuration exposed by the critical function (C:H, I:L, A:N).

Initial Access

Attacker sends an unauthenticated HTTP request directly to the panel's critical function endpoint over the network.

AML.T0049

Exploitation

Missing authentication check (CWE-306) allows the request to execute as if from a privileged admin session.

Impact

Attacker gains unauthorized access to confidential data or configuration exposed by the critical function (C:H, I:L, A:N).

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

1) Upgrade FTC E-Commerce Management Panel to version 1.0.2 or later, which addresses the missing authentication check. 2) Until patched, restrict network access to the panel via firewall rules, VPN, or IP allowlisting — do not expose the management interface directly to the internet. 3) Add WAF/reverse-proxy rules that reject requests to admin/critical-function endpoints lacking a valid session token. 4) Review access logs for unauthenticated requests to administrative endpoints as a compromise indicator. 5) Rotate any credentials or API keys that may have been reachable through the exposed function.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Framework AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.3 - Access control for AI system resources

OWASP LLM Top 10

N/A - Not directly applicable

Frequently Asked Questions

What is CVE-2026-12722?

This CVE describes a missing authentication check on a critical function in the FTC E-Commerce Management Panel, allowing any unauthenticated network attacker to reach privileged functionality directly (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). There is no EPSS score published, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code or Nuclei scanning template currently exists, so active mass exploitation has not been observed as of this writing. That said, the attack requires zero privileges and zero user interaction over the network, which is the profile of vulnerabilities that get weaponized quickly once a proof-of-concept surfaces. Note that this product's link to AI/ML is not established by the available description — it reads as a generic e-commerce administration panel, and the 'ml_ui' categorization here should be treated with low confidence until the vendor documentation confirms an AI-adjacent use case. Regardless of AI relevance, patch to version 1.0.2 or later immediately, and in the interim restrict network access to the management panel (VPN/allowlist) and monitor for unauthenticated requests to admin endpoints.

Is CVE-2026-12722 actively exploited?

No confirmed active exploitation of CVE-2026-12722 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12722?

1) Upgrade FTC E-Commerce Management Panel to version 1.0.2 or later, which addresses the missing authentication check. 2) Until patched, restrict network access to the panel via firewall rules, VPN, or IP allowlisting — do not expose the management interface directly to the internet. 3) Add WAF/reverse-proxy rules that reject requests to admin/critical-function endpoints lacking a valid session token. 4) Review access logs for unauthenticated requests to administrative endpoints as a compromise indicator. 5) Rotate any credentials or API keys that may have been reachable through the exposed function.

What systems are affected by CVE-2026-12722?

This vulnerability affects the following AI/ML architecture patterns: admin/management dashboards, web-based control panels.

What is the CVSS score for CVE-2026-12722?

CVE-2026-12722 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

admin/management dashboardsweb-based control panels

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.3

OWASP LLM Top 10: N/A

What are the technical details?

Original Advisory

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2.

Exploitation Scenario

An attacker scans the internet for exposed FTC E-Commerce Management Panel instances, identifies the vulnerable version (before 1.0.2), and sends a direct HTTP request to the critical function endpoint without providing any authentication token or session cookie. Because the application fails to enforce an authentication check on that endpoint (CWE-306), the request is processed as if it came from a legitimate authenticated administrator, exposing confidential data (C:H) accessible through that function. No user interaction or prior access is required, making this exploitable at scale by automated scanners once a public PoC emerges.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.