CVE-2026-60041
CSRF in backend
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
| CWE | CWE-352 |
| Vendor | mb connect line |
| Product | mbconnect24 |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for mb connect line mbconnect24
Be the first to know when new high vulnerabilities affecting mb connect line mbconnect24 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
MB connect line / mbCONNECT24
2.0.0 < 2.21.0
MB connect line / mymbCONNECT24
2.0.0 < 2.21.0
Helmholz / myREX24V2
2.0.0 < 2.21.0
Helmholz / myREX24V2.virtual
2.0.0 < 2.21.0
References
Credits
SySS GmbH