CVE-2026-21891: IceWhaleTech ZimaOS · Improper Authentication
Affects IceWhaleTech ZimaOSSource CVE Database V5
Not known to be exploited · public detection template (Nuclei) · CVSS 9.4 Critical.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 2.3% chance of exploitation in 30 days – higher than 83% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LExploitation evidence
Disclosed: evidence found.
CVE published 8 Jan 2026
Detectable: evidence found.
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| IceWhaleTechZimaOS | Affected
| Fixed in– |
GitHubicewhaletech/ZimaOSpkg:github/icewhaletech/ZimaOSOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Since no official patches are available, European organizations should implement the following specific mitigations: 1) Restrict network access to ZimaOS devices by implementing strict firewall rules and network segmentation to limit exposure to trusted hosts only. 2) Disable or rename default system service accounts if possible to reduce the risk of attackers guessing valid usernames. 3) Monitor authentication logs closely for unusual login attempts involving service account usernames and implement alerting for anomalous access patterns. 4) Employ multi-factor authentication (MFA) at network or application layers where feasible to add an additional barrier beyond the vulnerable OS authentication. 5) Use host-based intrusion detection systems (HIDS) to detect suspicious activities on affected devices. 6) Where possible, isolate critical ZimaOS devices from the internet and untrusted networks. 7) Engage with IceWhaleTech for updates and test patches promptly once available. 8) Consider deploying compensating controls such as VPNs with strong authentication to access ZimaOS devices. 9) Conduct regular security audits and penetration tests focused on authentication mechanisms in ZimaOS environments.
Description
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.