How do I check whether I am affected by CVE-2026-14177?

Hosted ikas platform: nothing to inspect locally. Test your storefront's password-reset form with a known and an unknown email and compare the message, status and timing. Ask ikas to confirm your tenant runs a build dated after 2026-07-13.

What is the fix for CVE-2026-14177?

Run ikas build dated 2026-07-13 or later (TR-CERT advice). Exact fixed build not published; confirm with ikas.

Who is not affected by CVE-2026-14177?

Not affected if: patched-after-2026-07-13.

Live › vulnerability › CVE-2026-14177

Go to dashboard

high7.5Other

IKAS E-Commerce Infrastructure: login responses reveal which accounts exist

ikas E-Commerce Infrastructure's password-reset response differs for registered and unregistered accounts (CWE-204), so anyone can confirm which emails have accounts. No auth needed; no known exploitation or PoC.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.5

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker confirms which accounts exist, enabling targeted attacks.
CVSS said: 7.5. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-14177

Go to dashboard

high7.5Other

IKAS E-Commerce Infrastructure: login responses reveal which accounts exist

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.5

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker confirms which accounts exist, enabling targeted attacks.
CVSS said: 7.5. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

IKAS E-Commerce Infrastructure: login responses reveal which accounts exist

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

IKAS E-Commerce Infrastructure: login responses reveal which accounts exist

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources