Quick answers
- Is CVE-2026-66340 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66340 being exploited in the wild.
- How severe is CVE-2026-66340?
- Medium severity, with a CVSS score of 5.3, published 11 August 2026.
- Which products and versions are affected?
- Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.
- Is there a fix for CVE-2026-66340?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-66340 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-66340?
- Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper restriction of excessive authentication attempts (CWE-640) in Mira's cloud authentication endpoints. The authentication service lacks per-account rate limiting, per-IP request throttling, and account lockout mechanisms following repeated failed login attempts. An attacker with network access can conduct brute-force attacks against user accounts without triggering any protective countermeasures. No authentication is required to initiate login attempts. Patches are available: Mira Monitor Firmware v01.07.01.53 and Mira Android App v4.5.18.
Affected products
- Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47
- Quanovate Tech Inc. Mira Android App 4.5.15.4
Timeline
- 2026-08-11: disclosed