CVE-2026-104105 error311 CVE debrief

Who should care

Defenders responsible for FileRise deployments should assess exposure and apply the fix to prevent potential replay attacks. This includes verifying exposure, reviewing and updating authentication settings, and monitoring for potential replay attacks. Additionally, defenders should prioritize verifying exposure and applying the fix for FileRise versions prior to 3.23.0.

Why it matters

CVE-2026-104105 is a medium-severity vulnerability in FileRise that allows TOTP code replay, potentially leading to unauthorized access.

• Verify exposure of FileRise versions prior to 3.23.0
• Apply fix to prevent TOTP code replay
• Monitor for potential replay attacks

Technical summary

FileRise versions prior to 3.23.0 have a TOTP code replay issue, allowing an attacker to replay a valid 6-digit code within its window. This issue does not by itself disclose the primary credential or TOTP code. The vulnerability is fixed in version 3.23.0. Defenders should prioritize verifying exposure and applying the fix for FileRise versions prior to 3.23.0. The CVE record and source item provide additional details on the vulnerability and its impact. The issue allows an attacker to replay a valid 6-digit TOTP code within its window, potentially leading to unauthorized access.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix for FileRise versions prior to 3.23.0.

Recommended defensive actions

• Verify FileRise version and apply fix if necessary
• Review and update authentication settings
• Monitor for potential replay attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the TOTP code replay issue in FileRise versions prior to 3.23.0. The issue allows an attacker to replay a valid 6-digit TOTP code within its window, potentially leading to unauthorized access. Defenders should verify exposure and apply the fix to prevent potential replay attacks. The CVE record was published on 2026-10-14T20:37:44.884Z and has not been modified since then. The source item provides additional details on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.