CVE-2025-26364

Summary

CVE-2025-26364 is a vulnerability classified as CWE-306 "Missing Authentication for Critical Function". In affected versions of Q-Free MaxTime (less than or equal to 2.11.0), an unauthenticated attacker can manipulate HTTP requests to disable an authentication profile server in the maxprofile/setup/routes.lua file. This vulnerability could potentially allow unauthorized access to protected resources or services. Successful exploitation may require a certain level of technical expertise, but it poses a significant risk to organizations that have not applied the necessary patches. It is strongly recommended that users upgrade to the latest version of Q-Free MaxTime to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.