CVE-2026-32865 is a critical password reset flaw in OPEXUS eComplaint and eCASE, scored CVSS 9.8. The password reset page returned the secret verification code in its own response, so knowing a user's email address was enough to reset the password and security questions. Upgrade to 10.1.0.0 or later.
What's affected
The NVD record says OPEXUS eComplaint and eCASE before version 10.1.0.0 are affected. The record points to a CISA CSAF advisory (VA-26-077-01), which I could not load, so the vendor and CISA advisories are the place to confirm the details for your deployment.
The affected page is ForcePasswordReset.aspx. The record says existing security questions are not asked during the process.
How to check if you're exposed
Read the product version in your administration console or deployment records and compare it with 10.1.0.0.
If you cannot upgrade immediately, check who can reach the application. Case management systems that take public submissions are often reachable from the internet.
Review recent password reset activity for accounts that did not ask for one.
What to do now
- Upgrade eComplaint or eCASE to 10.1.0.0 or later.
- Review password reset and security question changes since you first deployed the affected version.
- Force password resets for privileged accounts after the upgrade.
- Restrict access to the application to the networks that need it where possible.
- Check the CISA advisory VA-26-077-01 and contact OPEXUS for hosted instances.
Why it matters
The weaknesses are CWE-200, exposure of sensitive information, and CWE-640, a weak password recovery mechanism. A reset code only proves control of an email inbox if it travels by email. Sending the code back to the caller removes that proof.
Because the code also let someone replace security questions, the account would stay under the attacker's control. For systems holding complaint cases and personal data, account takeover has serious privacy effects. The record's KEV flag is false.
Quick check
What does an attacker need to know?
The record says an existing user's email address is enough.
Sources
Last reviewed: 19 October 2026.
