Is CVE-2026-22114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22114 being exploited in the wild.

How severe is CVE-2026-22114?

Informational severity, published 30 October 2026.

Is there a fix for CVE-2026-22114?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-22114 attacked?

It is attacked over the network.

Am I affected by CVE-2026-22114?

Check whether you run . Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22114: HTTP basic authentication missing rate limiting

CVE-2026-22114 · Severity: info · Published 2026-10-30

A service using HTTP basic authentication has no limit on login attempts or enforced delays between attempts, allowing attackers to brute-force credentials. Combined with a known default service password, this makes the authentication system vulnerable to rapid credential guessing attacks that bypass normal account protection mechanisms.

Technologies: <UNKNOWN>.

Quick answers

Is CVE-2026-22114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22114 being exploited in the wild.
How severe is CVE-2026-22114?: Informational severity, published 30 October 2026.
Which products and versions are affected?: <UNKNOWN>.
Is there a fix for CVE-2026-22114?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22114 attacked?: It is attacked over the network.
Am I affected by CVE-2026-22114?: Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

HTTP basic authentication implementation lacks retry limits or backoff delays, permitting unlimited authentication attempts. The vulnerability is amplified by the presence of a default service password with a limited keyspace, enabling exhaustive credential guessing via network access. No mitigation or patched version is documented in available advisories.

Affected products

<UNKNOWN>

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.