CVE-2026-11754: CWE-203 Observable discrepancy in Seres Software syWEB

This vulnerability (CVE-2026-11754) in Seres Software syWEB is classified as CWE-203, indicating an observable discrepancy that can be used for account footprinting. It allows an attacker to infer the existence of accounts by observing differences in system responses. The vulnerability affects syWEB versions up to 27082026. The vendor has confirmed the product is not supported, and no official remediation or patch is available. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a network attack vector with low complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can remotely exploit this vulnerability to perform account footprinting by observing discrepancies in system behavior or responses. This can lead to limited information disclosure about valid accounts in the system. There is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild.

No official patch or remediation is available as the product is no longer supported by the vendor. Organizations using syWEB should consider mitigating risk by restricting network access to the affected system, monitoring for suspicious activity, or migrating to supported software alternatives. Patch status is not yet confirmed — check the vendor advisory or official channels for any updates.