AKINSOFT WOLVOX Control Panel: Database credential disclosure

Summary

The AKINSOFT WOLVOX Control Panel, the management component of the WOLVOX ERP system, exposes sensitive information in data it sends (CWE-201). According to the CVE record, an unauthenticated remote attacker can pull data from system resources over the network, and the reported impact is database credentials. The affected range is 26.02.25 up to but not including 26.02.26. The CVSS score is disputed: NVD lists 9.8 with full impact on confidentiality, integrity and availability, while other sources list 9.1 without availability impact.

Affected

• AKINSOFT WOLVOX Control Panel from 26.02.25 before 26.02.26 (default configuration per CVE record: unaffected outside this range)

Fixed in

• Version 26.02.26 (according to secondary sources; vendor advisory not verified)

Workaround

• No vendor workaround identified. - General advice from one secondary source: restrict network access to the Control Panel to trusted IP addresses or a VPN using firewall rules. - Review logs for unusual outbound connections from the Control Panel process.

Exploitation

• A public proof-of-concept repository is listed for this CVE; its content was not reviewed. - CISA SSVC assessment: exploitation none, automatable yes, technical impact total. - No confirmed in-the-wild exploitation found; not verified in the CISA KEV catalogue. - EPSS 0.00373 at last capture.

Our recommendation

• Identify all WOLVOX installations and their versions, especially any at 26.02.25. - Confirm the fixed version with AKINSOFT and update to 26.02.26 or later; close the Control Panel before running the installer. - Until patched, block the Control Panel from the internet and limit access to management networks or VPN. - Rotate database and service credentials on affected systems and review logs for unusual outbound connections. - Check the NVD score before using it in reports, as sources disagree.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Enay-Project/CVE-2026-92555

Research sources

• TR-CERT advisory (Turkish Cyber Security Directorate) siberguvenlik.gov.tr
• Vulners: RAPID7 entry for CVE-2026-92555 vulners.com
• Strix: CVE-2026-92555 www.strix.ai
• Threatint: CVE-2026-92555 cve.threatint.com
• INCIBE early warning: CVE-2026-92555 www.incibe.es
• Sploitus: listed proof-of-concept sploitus.com
• TheHackerWire: AKINSOFT WOLVOX Control Panel data leakage www.thehackerwire.com
• AKINSOFT knowledge base: WOLVOX update procedure bilgibankasi.akinsoft.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:33.