PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1619 Universal Software Inc. CVE debrief

CVE-2026-1619 is an Authorization Bypass Through User-Controlled Key vulnerability in FlexCity/Kiosk, allowing Exploitation of Trusted Identifiers. This issue affects FlexCity/Kiosk versions from 1.0 before 1.0.36.

Vendor
Universal Software Inc.
Product
FlexCity/Kiosk
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-13
Original CVE updated
2026-06-06
Advisory published
2026-02-13
Advisory updated
2026-06-06

Who should care

Users of FlexCity/Kiosk versions from 1.0 before 1.0.36 should apply the patch to prevent exploitation.

Technical summary

The vulnerability has a CVSS score of 8.3 and is classified as HIGH severity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patch to upgrade FlexCity/Kiosk to version 1.0.36 or later.
  • Refer to [ref-5](https://www.usom.gov.tr/bildirim/tr-26-0065) for mitigation or vendor reference.

Evidence notes

The vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-1619) and has details on [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-1619).

Official resources

CVE-2026-1619 was published on 2026-02-13T14:16:10.067Z and modified on 2026-06-06T08:16:53.077Z.