CVE-2025-26138: Systemic-Rm Risk Value

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do not have permission to view.

Affected products

• Systemic-Rm Risk Value: up to and including 2.8.0

Published 2025-03-18. Last modified 2026-06-17.