Medium severity · published Mar 5, 2026
CVE-2026-30777
EC-CUBE provided by EC-CUBE CO.,LTD
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E4
EC-CUBE 4.1 series · EC-CUBE CO.,LTD.
prior to 4.1.2-p5 · source: vendor
E4
EC-CUBE 4.2 series · EC-CUBE CO.,LTD.
prior to 4.2.3-p2 · source: vendor
E4
EC-CUBE 4.3 series · EC-CUBE CO.,LTD.
prior to 4.3.1-p1 · source: vendor
EC
Ec-cube · Ec-cube
4.1.0 before 4.1.2; 4.2.0 before 4.2.3; 4.3.0 before 4.3.1; 4.1.2; 4.1.2; 4.1.2; +5 more · source: NVD