CVE-2026-40587

CVE-2026-40587 is a session invalidation vulnerability affecting blueprintUE (Unreal Engine developer tool) versions prior to 4.2.0. When users change their password or complete a password reset, the application fails to invalidate existing authenticated sessions, allowing attackers who previously compromised a session to maintain account access indefinitely until the session naturally expires, typically within 24 hours. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring high-level privileges but no user interaction. While the attack complexity is low, the potential impact is significant, as compromised sessions grant attackers full account access including confidentiality and integrity violations. The FAUCET Risk Score of 35.0/100 indicates moderate risk relative to other threats. Current exploitation status shows no active threat activity. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and the EPSS score of 0.00026 reflects minimal real-world exploitation likelihood. Community attention appears limited, and no public exploit code has been widely distributed. Organizations should prioritize updating to version 4.2.0 to remediate the vulnerability before exposure in production environments.