This vulnerability (CVE-2026-8285) in Universal Software Inc. FlexCity arises from improper restriction of excessive authentication attempts, which can cause excessive allocation of resources. The affected versions range from 5.536.0 through 11052026. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates that an attacker with low privileges can exploit this remotely without user interaction, resulting in an availability impact. There is no evidence of confidentiality or integrity compromise. The vulnerability is categorized under CWE-307 (Improper Restriction of Excessive Authentication Attempts). No patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability allows an attacker with low privileges to perform excessive authentication attempts without proper restriction, leading to excessive allocation of resources and potential denial of service (availability impact). There is no impact on confidentiality or integrity according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for unusual authentication activity and consider implementing rate limiting or other controls to mitigate excessive authentication attempts if possible.