CVE-2026-12622 is an open redirect vulnerability in Microchip GridTime 3000 GNSS Time Server affecting versions 1.0r0.03 through 1.1r0.0. The issue occurs in the password change form submission, allowing attackers to redirect users to untrusted external URLs. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official remediation or patch has been disclosed by Microchip as of the publication date.

Successful exploitation of this vulnerability could allow attackers to redirect users to malicious websites via the password change form, potentially facilitating phishing attacks or other social engineering exploits. There is no indication of direct system compromise or data breach from this vulnerability alone. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with password change forms and validate URLs carefully. Network-level controls or web application firewalls might help mitigate open redirect risks if configurable for this application.