Universal Software Inc. UKBS suffers from a missing authentication requirement for a critical function. This flaw allows an attacker who can invoke the function to bypass normal access controls and gain unintended access to the system’s internal operations. The vulnerability is a classic authentication bypass (CWE‑306) that directly undermines confidentiality, integrity, and availability, potentially enabling further exploitation or privilege escalation.

The affected product is Universal Software Inc. UKBS, with all releases up to and including version dated 28‑07‑2026 vulnerable. No specific sub‑versions are listed, so any build before that date should be considered at risk.

The CVSS score of 8.8 reflects high severity, and an EPSS score of less than 1% indicates that, while the feature is technically exploitable, the likelihood of active attacks remains very low at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not known to be actively exploited in the wild. The most probable attack vector involves remote users being able to call the exposed function over the network, but local or privileged attackers could also exploit the lack of authentication. Given the missing support notice, the opportunity for a vendor fix is absent, increasing the risk if the system remains exposed.