Medium severity · published Oct 2, 2026
CVE-2026-85209
IDOR in AVEZ Electronics's LMS
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Learning Management System (LMS): through 2026-09-18.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
Learning Management System (LMS) · AVEZ Electronics Communication Training and Consultancy Trade Inc.
through 2026-09-18 · source: vendor
Affected product
LM
Learning Management System (LMS)
AVEZ Electronics Communication Training and Consultancy Trade Inc.