Vulnerability · Published Jul 6, 2026 · Assigned by Canon_EMEA

CVE-2026-1433uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure

Medium 4.8

In plain English

A medium-severity security flaw in uniFLOW ULM (Universal Login Manager) Standalone from NT-ware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface (RUI). Exploitation requires administrative privileges and may disclose configuration data associated with SMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or uniFLOW Online are not affected.

Affected products (as reported)

Vendor	Product	Versions
NT-ware	uniFLOW ULM (Universal Login Manager) Standalone	0 – through 5.10

Weakness: CWE-522 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://www.canon-europe.com/psirt/advisory-information vendor-advisory
https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/2026+Security+Advisory+ULM+Potential+Information+Disclosure vendor-advisory, mitigation