CVE-2026-5387

CVE-2026-5387 is an authentication bypass vulnerability affecting simulator training systems that allows unauthenticated attackers to assume Simulator Instructor or Administrator privileges. The flaw enables unauthorized users to modify critical simulation parameters, training configurations, and training records without proper access controls. This represents a significant integrity and confidentiality risk for organizations relying on these systems for training purposes. The vulnerability has a FAUCET Risk Score of 53.0/100, indicating moderate concern, though no CVSS vector data is currently available. The attack requires no authentication and likely has low complexity, making it relatively accessible to potential threat actors. Successful exploitation could result in privilege escalation with broad impacts across simulation environment management and training data integrity. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is listed as inactive on threat intelligence platforms. The EPSS score of 0.00054 suggests very low probability of exploitation in the next 30 days. However, organizations should still prioritize patching given the severity of potential impacts and the ease of exploitation once the vulnerability becomes public knowledge.