The vulnerability identified as CVE-2026-8285 in Universal Software Inc. FlexCity is classified under CWE-307, which concerns improper restriction of excessive authentication attempts. This weakness allows an attacker to potentially cause excessive allocation, impacting the availability of the affected system. The affected versions are from 5.536.0 before 5.542.0. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impact limited to availability loss. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The impact of this vulnerability is limited to availability, as excessive authentication attempts can lead to resource exhaustion or denial of service conditions. There is no impact on confidentiality or integrity according to the CVSS vector. This could degrade service performance or cause temporary unavailability of FlexCity instances running affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing rate limiting or other controls to restrict excessive authentication attempts at the network or application level where possible.