# CVE-2026-11754: Seres syWEB observable discrepancy account footprinting

Source: https://junglewise.ai/threats/cve-2026-11754-seres-syweb-observable-discrepancy-account-footprinting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-11754 · Severity: medium · CVSS 5.3 · Published 2026-08-27

Seres syWEB is a web application platform used to manage software services. This vulnerability allows attackers to detect the existence or non-existence of user accounts through observable differences in system responses, enabling account enumeration without requiring authentication. This can facilitate unauthorized account discovery and targeted phishing or brute-force attacks.

Technologies: [Seres Software syWEB](https://junglewise.ai/threats/technologies/syweb). Vendors: [Seres Software](https://junglewise.ai/threats/vendors/seres-software).

## Quick answers

**Is CVE-2026-11754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11754 being exploited in the wild.

**How severe is CVE-2026-11754?** Medium severity, with a CVSS score of 5.3, published 27 August 2026.

**Which products and versions are affected?** Seres Software syWEB through 27082026.

**Is there a fix for CVE-2026-11754?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11754 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-11754?** Check whether you run Seres Software syWEB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an observable discrepancy (information disclosure) flaw in syWEB that enables account footprinting. The application returns different responses when queried about valid versus invalid user accounts, allowing unauthenticated attackers to enumerate existing accounts via the network. This is a reconnaissance technique that does not directly compromise user data but significantly lowers the barrier to subsequent account compromise attacks. The vendor confirmed the product is no longer supported and will not receive patches.

## Affected products

- Seres Software syWEB through 27082026

## Timeline

- 2026-08-27: disclosed
- other: Vendor confirmed product is no longer supported and will not receive patches

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0932](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0932)

## Related threats

- [Seres Software syWEB reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-11747-seres-software-syweb-reflected-cross-site-scripting)
- [Seres Software syWEB reflected XSS](https://junglewise.ai/threats/cve-2025-8461-seres-software-syweb-reflected-xss)