This vulnerability (CVE-2026-49066) affects Conekta Payment Gateway versions up to 6.0.0, enabling unauthenticated attackers to access sensitive system information. The weakness corresponds to CWE-497, which involves exposure of sensitive data to unauthorized control spheres. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to confidentiality loss, with no integrity or availability impact reported. No official remediation or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation results in unauthorized disclosure of sensitive system information, potentially aiding attackers in further attacks or reconnaissance. The confidentiality of the system is compromised, but integrity and availability remain unaffected. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor vendor communications for updates. Until a patch is available, consider restricting external access to the affected service and applying compensating controls to limit exposure of sensitive information.