CVE-2026-79957 ServiceNext CVE debrief

Who should care

Defenders responsible for ServiceNext's SerTec product, particularly those managing user authentication and authorization, should assess exposure and prioritize remediation to prevent potential account takeover and credential-stuffing attacks.

Why it matters

CVE-2026-79957 is a high-severity vulnerability in ServiceNext's SerTec product, allowing authenticated users to retrieve full profile records of other users, including cleartext passwords, via an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint. Defenders should prioritize verifying exposure of SerTec version 1.00 and assessing the feasibility of user enumeration and credential theft to prevent potential account takeover and credential-stuffing attacks.

• Authenticated users can enumerate and retrieve sensitive information of other users
• Cleartext passwords are stored in the system, enabling potential credential-stuffing attacks
• Account takeover is possible due to the IDOR vulnerability
• Defenders need to verify exposure and assess the feasibility of user enumeration and credential theft

Technical summary

The /api/Usuario/GetUsuarios endpoint in ServiceNext's SerTec product is vulnerable to an insecure direct object reference (IDOR) attack, allowing authenticated users to retrieve full profile records of other users, including cleartext passwords stored in the system. The vulnerability enables potential account takeover and credential-stuffing attacks. Defenders should prioritize verifying exposure of SerTec version 1.00 and assessing the feasibility of user enumeration and credential theft to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying exposure of SerTec version 1.00 and assessing the feasibility of user enumeration and credential theft.

Recommended defensive actions

• Verify exposure of SerTec version 1.00
• Assess the feasibility of user enumeration and credential theft
• Implement additional authentication and authorization controls for the /api/Usuario/GetUsuarios endpoint
• Consider upgrading to a patched version of SerTec if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the IDOR vulnerability, cleartext password storage, and potential for account takeover and credential-stuffing attacks. The vulnerability is confirmed in SerTec version 1.00, and defenders should verify exposure and assess the feasibility of user enumeration and credential theft. The source item provides additional information on the vulnerability, and the CVE Program record offers official CVE metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.