CVE-2026-1433 is an information disclosure vulnerability in NT-ware uniFLOW ULM Standalone. It allows an authenticated administrator to retrieve sensitive configuration details through the ULM Remote User Interface. The disclosed information may include SMTP and LDAP integration settings. This issue does not affect ULM instances connected to uniFLOW Server or uniFLOW Online. Exploitation requires administrative privileges, and no privilege escalation or remote unauthenticated access is indicated. No official remediation or patch has been documented as of the publication date.

An attacker with administrative privileges on uniFLOW ULM Standalone can access sensitive configuration information, potentially exposing SMTP and LDAP integration details. This could aid in further targeted attacks or configuration manipulation. However, the vulnerability does not allow privilege escalation or remote unauthenticated exploitation, limiting its impact to authorized administrators only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should limit administrative access to trusted personnel only and monitor for any unusual activity. Deployments connected to uniFLOW Server or uniFLOW Online are not affected, so consider these alternatives if feasible.