The vulnerability is a missing authentication flaw that lets attackers, without valid credentials, call specific functions on the Vitals ESP service to retrieve confidential data. This breach of confidentiality is the primary harm, allowing remote actors to obtain sensitive information exposed by the application.

Galaxy Software Services’ Vitals ESP product is affected. No specific version range is given in the advisory, so all deployed instances of Vitals ESP could be vulnerable until the vendor issues a fix.

The CVSS score of 8.7 marks it as high severity. The exploit probability is not estimated in the advisory. It is not listed in the CISA KEV catalog. Exploitation requires simply sending HTTP requests to the exposed endpoints; no authentication is needed, making it straightforward for attackers who can reach the service.