{"id":"CVE-2026-41562","published":"2026-10-06T09:17:54.023","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/norvis-backup/vulnerability/wordpress-norvis-backup-plugin-1-1-0-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Norvis Backup application exposes sensitive data without requiring authentication, allowing attackers to access backup files and configuration information. This unauthenticated access can lead to data breaches and system compromise.","exploitability":"Exploitation is straightforward with no prerequisites as the vulnerability affects unauthenticated endpoints that expose sensitive backup data.","blast_radius":"The impact could be significant across all systems running vulnerable versions of Norvis Backup, potentially exposing multiple backup sets and sensitive configuration details to unauthorized parties.","remediation":"Upgrade to version 1.1.1 or later to address the sensitive data exposure vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfiltration","backup","unauthenticated-access"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:54.225Z"}}