CVE-2025-26366

Summary

CVE-2025-26366 is a critical vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. This issue, classified as a CWE-306 "Missing Authentication for Critical Function," allows unauthenticated remote attackers to manipulate the front panel authentication setting through specially crafted HTTP requests. Successful exploitation of this vulnerability enables attackers to bypass the authentication mechanism, potentially leading to unauthorized access and control of affected systems. This vulnerability underscores the importance of implementing proper authentication checks in all critical functions and updating software to the latest security patches.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.