CVE-2022-41400

9.8 criticalEPSS 0.6%

Critical (9.8) in sage sage 300. EPSS 0.6% chance of exploitation in the next 30 days.

Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2023-04-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sage:sage_300

References

https://www.sage.com/en-ca/products/sage-300/
https://www.sage.com/en-ca/products/sage-300/

Check your stack JSON