Integrics Enswitch Auth Bypass: Unauthenticated Users Can Seize Admin Access in CVE-2026-107640

Security researchers have identified a critical authentication bypass vulnerability in Integrics Enswitch that allows unauthenticated attackers to reset user passwords. The flaw, tracked as CVE-2026-107640, resides in the API endpoint responsible for updating user passwords. According to the National Vulnerability Database (NVD), the issue stems from improper handling of the reset parameter, which enables attackers to modify account credentials without providing valid authentication tokens or existing passwords.

The risk

The vulnerability is classified under CWE-640, indicating an average weakness in authentication mechanisms. The NVD assigns the flaw a CVSS score of 9.3, categorizing it as Critical. The technical vector involves an attacker targeting the `/api/json/user/password/update/` endpoint. By omitting the required reset parameter, the system defaults to an empty value. This behavior allows the request to proceed if the targeted account has no pending password reset and its `reset_key` is empty, matching the defaulted empty value provided by the attacker.

This mechanism effectively bypasses standard authentication checks. Once an attacker successfully changes a password, they gain full access to the compromised account. The NVD record notes that this technique is particularly dangerous for administrator accounts, as attackers can enumerate valid usernames and subsequently take over privileged roles within the Enswitch platform. This level of access could allow malicious actors to manipulate network configurations, disable security controls, or exfiltrate sensitive data managed through the platform.

Who is exposed

The vulnerability affects Integrics Enswitch versions 3.13 through 4.4. Any organization running these specific versions of the software is potentially exposed to this attack vector. The risk is heightened for deployments where administrator accounts are active and where username enumeration is possible. Organizations that have not yet upgraded beyond version 4.4 must consider their systems vulnerable until a patched version is confirmed and deployed.

Cost and compliance

The source material does not provide specific data regarding financial costs, regulatory penalties, or compliance implications associated with this vulnerability. However, unauthorized access to administrative accounts in network management platforms typically violates standard security frameworks and data protection regulations, potentially leading to significant operational and legal consequences for affected organizations.

What to watch

IT managers should immediately audit their Integrics Enswitch installations to determine if they are running versions 3.13 through 4.4. If affected versions are in use, teams should restrict access to the `/api/json/user/password/update/` endpoint and monitor for unauthorized password change attempts. Until a confirmed patch is available, implementing strict network segmentation and monitoring for anomalous API requests can help mitigate the risk of account takeover.

Background: Authentication bypass vulnerabilities

Authentication bypass vulnerabilities arise from logic flaws, improper session handling, and misconfigured permissions. These mistakes let attackers access data without valid credentials. Fixing them requires strict input validation, secure session management, and regular vulnerability scanning to identify weak points before exploitation.

Read the full guide: Authentication Bypass Mistakes That Leave Systems Exposed

What to do and how to stay safe: Integrics

• Severity scores alone ignore your specific environment and asset value.
• Contextual data like internet exposure changes the urgency of a flaw.
• Manual review of scan results prevents alert fatigue and wasted effort.

Fix the holes that attackers can actually reach, not just the ones with the highest scores. Start by patching internet-exposed systems with known exploit code today.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-107640?

The CVSS score for CVE-2026-107640 is 9.3, which is rated as Critical.

Which versions of Integrics Enswitch are affected by this vulnerability?

Integrics Enswitch versions 3.13 through 4.4 are affected by this authentication bypass vulnerability.

How do attackers exploit this flaw to change passwords?

Attackers exploit the flaw by omitting the reset parameter in requests to the password update API endpoint, causing the system to default to an empty value that matches accounts with no pending resets.