CVE-2026-32650

Published: Apr 17, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: ics-cert@hq.dhs.gov (Secondary)

Description

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.

Affected (1)

Products: Anviz: Crosschex Standard

Anviz

1 product

Crosschex Standard

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Anviz Crosschex Standard	All versions

Related CWEs

CWE-757

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

References (3)

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json

Source: ics-cert@hq.dhs.gov

Third Party Advisory

https://www.anviz.com/contact-us.html

Source: ics-cert@hq.dhs.gov

Product

https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03

Source: ics-cert@hq.dhs.gov

US Government Resource

Timeline

No history available yet.