CVE Intelligence
Analysis AI-assisted

CVE-2026-6795: DivvyDrive Open Redirect via Parameter Injection (CWE-601)

CVE-2026-6795 is an open redirect weakness (CWE-601) in DivvyDrive, published on 2026-05-07 with a CNA-assigned CVSS 3.1 score of 9.6 (critical). The record states that versions from 4.8.2.9 before 4.8.3.2 are affected. No exploitation in the CISA KEV catalog or other consulted sources was found, and the record does not name a fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-6795 describes an open redirect issue (CWE-601) in DivvyDrive from DivvyDrive Information Technologies Inc. According to the record, the flaw involves parameter injection that can send users to an untrusted site. The CVE was published on 2026-05-07 and is attributed to the CNA iletisim@usom.gov.tr.

Impact

  • The CNA assigned a CVSS 3.1 base score of 9.6 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
  • The vector indicates network exploitation, no privileges required, user interaction required, a scope change, and high impact on confidentiality, integrity and availability. Reading these metrics beyond the score is an inference.
  • Open redirects are commonly used to lend a trusted domain to phishing links. Whether this applies here is an inference, since the record does not describe an impact scenario.

Affected products and versions

  • Product: DivvyDrive, vendor DivvyDrive Information Technologies Inc.
  • Stated range: from 4.8.2.9 before 4.8.3.2.
  • Fixed version: not explicitly stated in the record. The version 4.8.3.2 is the first version outside the stated range, but the vendor fix should be confirmed.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The FIRST EPSS probability is 0.00395, with a percentile of 0.31855.

Remediation and mitigation

  • Inventory DivvyDrive installations and identify any running a version in the stated range.
  • Plan an upgrade to 4.8.3.2 or later, confirming the correct release and fix details with the vendor.
  • Until patched, limit exposure of the application and review any redirect functionality that accepts user-supplied input.

Detection guidance

  • Review web server and application logs for requests where redirect destinations point to external domains.
  • Watch for unusual referrals from trusted domains to unfamiliar hosts, particularly from links in emails or messages.

Limitations of the available information

  • The record does not identify the affected parameter, the vendor advisory, or the exact fixed version.
  • The national advisory referenced in the record was not reviewed for further detail in this analysis.
  • The record's source status is Deferred, and the CNA's assessment has not been independently verified against vendor data.

Frequently asked questions

What is CVE-2026-6795?

It is an open redirect weakness (CWE-601) in DivvyDrive, where the record says parameter injection can send users to an untrusted site.

Which DivvyDrive versions are affected?

The record states versions from 4.8.2.9 before 4.8.3.2. The fixed version is not explicitly named, so confirm with the vendor.

Is this vulnerability being actively exploited?

It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.