{"id":"CVE-2026-15575","kind":"vulnerability","aliases":["CVE-2026-15575"],"related":[],"title":"Costifier: active debug code exposes non-production interfaces to attackers","description":"Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces.\n\nThis issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","summary":"SFM Software Technologies' Costifier ships with debug code left active, which exposes non-production interfaces. The sources do not say what an attacker can do through those interfaces, and the vendor did not respond to the disclosure.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["costifier","sfm-software","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:33+00:00","updated_at":"2026-10-25T04:28:33+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-25T04:28:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Costifier: active debug code exposes non-production interfaces to attackers","impact":"medium","summary":"SFM Software Technologies' Costifier ships with debug code left active, which exposes non-production interfaces. The sources do not say what an attacker can do through those interfaces, and the vendor did not respond to the disclosure.","category":"vendor","nicknames":[],"who_cares":["costifier","sfm-software"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; debug interfaces may expose internal functions or data","analyst_note":"Find the vendor advisory or a technical write-up of which debug interfaces are exposed, the affected versions, and whether a fix exists; the NVD entry gives only CVSS 5.3 and no details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Costifier from SFM Software Technologies. The sources name no version range beyond 'through 2026-10-16' and do not say which deployments expose the debug interfaces, so the exposure path is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000544,"input_tokens":3297,"output_tokens":429,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':83C '-15575':14A,17A '-16':84C '-2026':13A,16A '2026':82C 'activ':2A,32B,61C 'affect':79C 'allow':71C 'attack':11A,46B 'code':4A,30B,63C 'contact':89C 'costifi':1A,18B,26B,70C,80C 'cve':12A,15A 'debug':3A,29B,62C 'disclosur':60B,93C 'earli':90C 'exploit':72C 'expos':5A,34B 'inc':69C 'interfac':9A,38B,51B,76C 'issu':78C 'left':31B 'non':7A,36B,74C 'non-product':6A,35B,73C 'note':85C 'product':8A,37B,75C 'respond':57B,97C 'say':43B 'sfm':20B,23B,66C 'sfm-softwar':19B 'ship':27B 'softwar':21B,24B,67C 'sourc':40B 'technolog':25B,68C 'vendor':22B,54B,87C 'vulner':64C 'way':100C","nicknames":[],"mitigations":[],"who_affected":"Teams running Costifier from SFM Software Technologies. The sources name no version range beyond 'through 2026-10-16' and do not say which deployments expose the debug interfaces, so the exposure path is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15575","severity":null,"published_at":"2026-10-16T09:17:04+00:00","modified_at":"2026-10-16T15:21:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}