Vulnerability · Published Mar 19, 2026 · Assigned by cisa-cg
CVE-2026-32865OPEXUS eComplaint and eCase insecure password reset
Critical 9.8
In plain English
A critical-severity information exposure in eCASE from OPEXUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OPEXUS | eComplaint | 0 – before 10.1.0.0 |
| OPEXUS | eCASE | 0 – before 10.1.0.0 |
Weakness: CWE-200, CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H