CVE-2026-102458: Digiwin Easyflow .net

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.

Affected products

• Digiwin Easyflow .net: from 6.1, before 6.2 (fixed in 6.2); from 6.6, up to and including 6.6.19; from 8.1, up to and including 8.1.5

Published 2026-09-30. Last modified 2026-09-30.