PT-2026-66447

CVE-2026-16971

Published

2026-07-30

Updated

2026-07-30

Description by

CVSS 3.1

5.9

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IRIS versions 2.4.26 and earlier

Description The web application fails to protect its Multi-Factor Authentication (MFA) validation process against brute-force attacks, which occur when an attacker systematically tries all possible combinations of a password or code until the correct one is found.

Recommendations Update to a version later than 2.4.26.

Exploitability

Exploit

Fix

Impacts

Researchers

Mathias Tausig

Michael Koppmann

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling