CVE-2026-6835

CVE-2026-6835 is an arbitrary file upload vulnerability in the a+HCM application developed by aEnrich that permits unauthenticated remote attackers to upload files to any location on the system, including HTML documents that could be served to users. This lack of access controls represents a significant exposure for organizations using the affected product. The vulnerability carries a CVSS 3.1 score of 6.1 (MEDIUM severity) with a network-based attack vector requiring no authentication but depending on user interaction. The attack has low complexity and could result in confidentiality and integrity impacts through stored XSS-like effects, though availability is not compromised. The relatively low EPSS score of 0.0003 suggests this is not currently prevalent among discovered vulnerabilities. There is currently no evidence of active exploitation, and the vulnerability does not appear on the Known Exploited Vulnerabilities catalog. The FAUCET risk score of 43/100 and inactive status on threat lists indicate minimal community attention and exploitation activity at this time. However, organizations using a+HCM should prioritize patching given the ease of exploitation for unauthenticated attackers.