ServiceNext CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ServiceNext CVE published 2026-10-14

CVE-2026-79957

CVE-2026-79957 is a high-severity vulnerability in ServiceNext's SerTec product, allowing authenticated users to retrieve full profile records of other users, including cleartext passwords, via an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint. The vulnerability enables potential account takeover and credential-stuffing attacks. Defenders responsible for ServiceNext's Ser [truncated]