CVE-2026-100903 NPO Ritm CVE debrief

Who should care

Defenders responsible for GEOritm systems, especially those with publicly accessible REST API endpoints, should assess exposure and prioritize upgrading to version 2.46 if vulnerable. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and implement necessary mitigations.

Why it matters

Defenders should prioritize verifying exposure of GEOritm systems and upgrading to version 2.46 due to potential authentication bypass vulnerability.

• Potential authentication bypass
• Possible remote exploitation requires verification
• Upgrade to version 2.46 to mitigate

Technical summary

The vulnerability affects an unknown part of the file /restapi/objects/obj-groups of the component REST API in GEOritm up to 2.45.1. Manipulation of the argument objectId leads to missing authentication, allowing remote attacks. The vendor has implemented security fixes in version 2.46. Defenders should prioritize verifying exposure of GEOritm systems and upgrading to version 2.46 if vulnerable. The vulnerability has been registered under identifier BDU:2026-11235 by the Russian Federal Service for Technical and Export Control (FSTEC Russia).

Defensive priority

Defenders should prioritize verifying exposure of GEOritm systems, especially those with publicly accessible REST API endpoints, and upgrade to version 2.46 if vulnerable.

Recommended defensive actions

• Verify exposure of GEOritm systems, especially those with publicly accessible REST API endpoints
• Upgrade to version 2.46 if vulnerable
• Monitor for potential authentication bypass attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The scope of affected systems and potential impact require further verification. Defenders should verify exposure of GEOritm systems, especially those with publicly accessible REST API endpoints, and assess potential authentication bypass vulnerability. The vendor's confirmation and security fixes in version 2.46 are noted.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.