CVE-2026-16471 is a high severity (CVSS 7.5) missing authorization flaw in Dolusoft Software Technologies Sonlogger, from version 6.6.6 before 6.7.4.8. An unauthenticated remote user can reach functionality that access controls should restrict. Upgrade to 6.7.4.8 or later and read the national advisory.
What's affected
Dolusoft Software Technologies Sonlogger from v6.6.6 before 6.7.4.8, per the NVD record. That means 6.7.4.8 is the first version outside the affected range as the record states it.
The record points to advisory TR-26-0849 from the Turkish national cyber security body. When I fetched that page, it returned only a page shell without readable advisory text, so I could not confirm further details such as component names or fix notes from the advisory itself. Read the advisory directly and ask the vendor for release notes before you rely on any other detail.
How to check if you're exposed
Log in to Sonlogger as an administrator and read the product version from the about or settings page. Any version from 6.6.6 up to but not including 6.7.4.8 is affected.
Then check how Sonlogger is exposed. If the web interface is reachable from the internet or from broad internal ranges, restrict it with a firewall or VPN while you plan the upgrade. The record shows no privileges and no user interaction are needed, so network reachability is the main control you have.
What to do now
- Read the Sonlogger version in the admin interface.
- If it is in the 6.6.6 to before 6.7.4.8 range, upgrade to 6.7.4.8 or later from the vendor.
- Limit network access to the Sonlogger web interface to the hosts that need it.
- Read advisory TR-26-0849 and any vendor notes for further steps.
- Review access logs for requests to administrative functions from unexpected sources.
Why it matters
CWE-862 is missing authorization. The software offers a function but does not check whether the caller is allowed to use it. This differs from a broken login. Here the check is simply absent for some paths, so a visitor with no account can reach things that an ACL was meant to guard.
The record rates the impact as high for confidentiality only, so the main concern is disclosure of data that the logging platform holds. Logging tools collect sensitive records by design, which makes even a read-only flaw worth closing quickly.
The weakness class here is CWE-862 (Missing Authorization). The NVD record scores it 7.5, which is high severity. The CVSS vector reads attack vector over the network, low attack complexity, no privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated high, none and none. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Try it yourself
A free in-browser dependency scan at gold.safeguard.sh/scan shows which of your components match known CVEs. The demo below walks through the idea.
Click through it at your own pace, or open it full screen.
Quick check
Does the record say the flaw is exploited?
No. The record does not flag it as known exploited, and I could not read any advisory text that says so. Treat the missing authorization as a reason to patch and to restrict network access.
Sources
- National advisory TR-26-0849 (page returned no readable details when fetched)
- Safeguard Gold entry for CVE-2026-16471, which summarizes the NVD record
Last reviewed: 18 October 2026.
