CVE-2026-32650
Encryption Bypass in Anviz CrossChex Enables Database Credential Exposure
Publication date: 2026-04-17
Last updated on: 2026-05-04
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| anviz | crosschex_standard | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-757 | A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Anviz CrossChex Standard occurs when an attacker manipulates the TDS7 PreLogin process to disable encryption.
This manipulation causes database credentials to be transmitted in plaintext.
As a result, an attacker can gain unauthorized access to the database.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to your database because credentials are sent without encryption.
An attacker could intercept these plaintext credentials and use them to access sensitive data.
The impact includes potential data breaches and exposure of confidential information.