On October 22, TWCERT/CC published TVN-202610006: New Type Information Co.'s NT OneAPP enterprise cloud management system contains five vulnerabilities, including CVE-2026-114220 (improper credential validation, CVSS v4.0 9.3) and CVE-2026-114219 (hardcoded credentials, CVSS v4.0 9.1), alongside credential leakage, authentication bypass, and sensitive information exposure [1]. Versions V1.5.22 and earlier are affected; update to V1.5.35 or later [1].
Critical9.3MonitoringOfficially confirmedCVE-2026-114219CVE-2026-114220CVE-2026-114221CVE-2026-114222CVE-2026-114223
New Type Information NT OneAPP Enterprise Cloud Management System Contains Five Vulnerabilities, Including Hardcoded Credentials and Improper Authentication (CVSS Up to 9.3)
1 min read
- Disclosed
- Oct 22, 2026
- Published
- Nov 7, 2026
- Last updated
- Nov 6, 2026
- CVSS basis
- [1]
- 0.3%, higher than 28% of CVEs
- Exploitation and patch status
- Patch available
- Technology
- Vulnerability status
On this page
30-second summary
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| 新人類資訊科技 NT OneAPP 企業雲端管理系統 | <= V1.5.22[1] | V1.5.35 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
- TWCERT/CC publishes TVN vulnerability advisory; patched version released[1]
Technical details
Vulnerability Details
The five vulnerabilities are CVE-2026-114219 (hardcoded credentials, 9.1), CVE-2026-114220 (improper credential validation, 9.3), CVE-2026-114221 (credential leakage, 5.9), CVE-2026-114222 (authentication bypass, 6.9), and CVE-2026-114223 (exposure of sensitive information, 6.7); both critical-severity vulnerabilities can be exploited over the network without authentication [1].
Remediation
Vendor guidance
- 1Update to V1.5.35 patch[1]
References
Official / primary1
- [1]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.