CVE-2018-12596

CVE-2018-12596 is a critical improper access restriction vulnerability affecting Episerver Ektron CMS versions prior to 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, and 9.2 before SP2 Site CU 22. This flaw allows unauthenticated remote attackers to bypass access controls and execute aspx pages, including those typically restricted to local administrators within the /WorkArea/ path, via the "activateuser.aspx" page. With a CVSSv3 score of 9.8 (CRITICAL), this vulnerability poses a severe risk, enabling complete compromise of confidentiality, integrity, and availability of the affected system without requiring user interaction or authentication. The EPSS score of 0.479190000 indicates a higher-than-average probability of exploitation compared to other CVEs. While not listed in CISA's KEV catalog, an exploit (EDB-45577) is publicly available on ExploitDB, confirming the feasibility of exploitation. Despite the critical severity and public exploit, there is minimal community discussion or media coverage surrounding this CVE.