Security readout for executives and security teams
Plain-English summary
CVE-2026-26367 lets any authenticated standard user on affected JUNG eNet SMART HOME server versions delete other user accounts, except the built-in admin. This can disrupt operations and remove legitimate access without administrator approval. It requires a valid low-privileged account, so risk is highest where many users or weak account controls exist.
Executive priority
Treat as high priority for affected smart building or home automation environments. The issue can remove user access and disrupt operations, but current evidence requires an authenticated low-privileged account and does not show known active exploitation.
Technical view
Affected JUNG eNet SMART HOME server 2.2.1 (46056) and 2.3.1 (46841) lack proper authorization on the deleteUserAccount JSON-RPC management method. The flaw is CWE-862 missing authorization. CVSS 3.1 is 8.1, with network access, low attack complexity, low privileges required, no user interaction, and high integrity and availability impact.
Likely exposure
Exposure is limited to deployments of the listed JUNG eNet SMART HOME server versions where an attacker can authenticate as a standard UG_USER account and reach the management JSON-RPC interface. The sources do not state whether internet-facing systems are common.
Exploitation context
The provided sources describe a crafted authenticated request causing arbitrary user deletion. There is no KEV listing in the source bundle and no cited evidence of active exploitation. Exploitation requires valid low-privileged credentials.
Researcher notes
The record identifies a missing RBAC check in deleteUserAccount under /jsonrpc/management. Sources provide affected versions and impact but do not include an official vendor patch status in the provided bundle. Avoid assuming additional versions or products are affected.
Mitigation direction
- Check JUNG vendor guidance for an official update or workaround.
- Restrict management interface access to trusted networks and administrators.
- Minimize and review low-privileged user accounts on affected servers.
- Monitor for unexpected user deletion or account-management events.
- Back up configuration and account data where supported.
Validation and detection
- Inventory JUNG eNet SMART HOME server deployments and firmware versions.
- Confirm whether versions 2.2.1 (46056) or 2.3.1 (46841) are present.
- Review user roles and remove unnecessary standard accounts.
- Check logs or audit records for unexpected account deletions.
- Verify management access is not broadly reachable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-26367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- ZeroScience Vulnerability Advisory ZSL-2026-5973CVE reference · third-party-advisory
- VulnCheck Advisory: JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccountCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.