CVE-2026-18362 describes a vulnerability in the IRIS web application (iris-web) version 2.4.26 where the authentication mechanism lacks protection against brute-force attacks. This is categorized under CWE-770, indicating allocation of resources without limits or throttling. The vulnerability allows an attacker to repeatedly attempt authentication without restriction, potentially leading to resource exhaustion or unauthorized access attempts. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or official remediation level has been provided by the vendor as of the published date.

The vulnerability allows attackers to perform brute-force attacks against the user authentication mechanism, potentially compromising confidentiality by gaining unauthorized access. There is no impact on integrity or availability reported. The lack of throttling or limits on resource allocation during authentication attempts can lead to resource exhaustion or facilitate credential guessing attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or brute-force protection mechanisms at the network or application gateway level to mitigate attack attempts.