Is CVE-2026-79576 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79576 being exploited in the wild.

How severe is CVE-2026-79576?

Critical severity, with a CVSS score of 9.8, published 8 September 2026.

Which products and versions are affected?

Risesoft Digital-Infrastructure 9.6.7 and earlier.

Is there a fix for CVE-2026-79576?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79576 attacked?

It is attacked over the network.

Am I affected by CVE-2026-79576?

Check whether you run Risesoft Digital-Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79576: Digital-Infrastructure SSO authentication bypass

CVE-2026-79576 · Severity: critical · CVSS 9.8 · Published 2026-09-08

Digital-Infrastructure is an enterprise identity and access management platform used to control employee authentication and permissions across organizations. A critical flaw in its Single-Sign On (SSO) component allows attackers to log in as any user—including administrators—without knowing their password, potentially granting full control over the system and access to sensitive organizational data.

Technologies: Risesoft Digital-Infrastructure. Vendors: Risesoft.

Quick answers

Is CVE-2026-79576 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79576 being exploited in the wild.
How severe is CVE-2026-79576?: Critical severity, with a CVSS score of 9.8, published 8 September 2026.
Which products and versions are affected?: Risesoft Digital-Infrastructure 9.6.7 and earlier.
Is there a fix for CVE-2026-79576?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79576 attacked?: It is attacked over the network.
Am I affected by CVE-2026-79576?: Check whether you run Risesoft Digital-Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Y9AuthenticationHandler.authenticate method, which handles SSO logins. When a login request specifies loginType=qrCode, the handler retrieves a user by personId without verifying any password or QR-code state, bypassing the bcryptMatch validation required for other login types. The attacker can obtain the RSA public key from the unauthenticated /sso/api/getRsaPublicKey endpoint, use it to encrypt a known personId (which may be leaked via other application flaws), and submit a forged qrCode-type login request. Since there are no tenant restrictions or QR-code state checks, authentication succeeds immediately. The flaw affects Digital-Infrastructure v9.6.7 and earlier; patches or mitigations are not yet confirmed in the advisory.

Affected products

Risesoft Digital-Infrastructure 9.6.7 and earlier

Timeline

2026-09-08: disclosed

References

https://github.com/fangtang7/CVE/blob/main/Digital-Infrastructure/sso.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.