CVE-2026-32865 CRITICAL

CVE-2026-32865: OPEXUS eComplaint and eCase insecure password reset

Vendor Opexus
Product eComplaint
Weakness CWE-200 · Info exposure
Published March 19, 2026
Last update March 19, 2026
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 19, 2026 Record updated