PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-30290 Intouchapp CVE debrief

CVE-2026-30290 is an arbitrary file overwrite vulnerability in InTouch Contacts & Caller ID APP v6.38.1. This vulnerability allows attackers to overwrite critical internal files via the file import process, potentially leading to arbitrary code execution or information exposure. The vulnerability has a high severity with a CVSS score of 8.4. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked, and exceptions should be tracked and retested before closing the item.

Vendor
Intouchapp
Product
Intouch Contacts & Caller Id
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of InTouch Contacts & Caller ID APP v6.38.1 should be aware of this vulnerability and take steps to mitigate it. This includes applying any available patches from the vendor and monitoring for suspicious activity. Operators, administrators, and security teams should review the vulnerability details and assess their exposure.

Technical summary

The vulnerability exists in the file import process of InTouch Contacts & Caller ID APP v6.38.1. An attacker could exploit this vulnerability by importing a specially crafted file, potentially leading to arbitrary code execution or information exposure. The CVSS score for this vulnerability is 8.4, indicating a high severity. Users should apply available patches from the vendor and monitor for suspicious activity.

Defensive priority

High

Recommended defensive actions

  • Apply available patches from the vendor
  • Monitor for suspicious activity
  • Restrict access to the file import process
  • Implement additional security controls to detect and prevent exploitation
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T20:16:26.670Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vulnerability exists in InTouch Contacts & Caller ID APP v6.38.1. Evidence is limited to CVE and NVD details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-30290 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-30290

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-30290 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-30290

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.