/
2026: Security Advisory: ULM Potential Information Disclosure

2026: Security Advisory: ULM Potential Information Disclosure

Summary

Potential information disclosure compromises possible once logged into the ULM with admin management rights.

Advisory release date

Jul 6, 2026

Product

ULM (uniFLOW Universal Login Manager Standalone)

CVE

CVE-2026-1433

Summary of Vulnerability

ULM when running in standalone mode has been found to have a vulnerability where if exploited could result in sensitive configuration information being exposed. This is ONLY possible if you have first logged into the admin interface of ULM running in standalone mode, greatly limiting the exposure.

NOTE:

  • This does NOT impact ULM when connected to uniFLOW Server or uniFLOW online. This is only found in the standalone (Free) offering.

  • This vulnerability is only found where the installation of the ULM client is bound to an LDAP server which is not a common configuration, and most installations will be unaffected.

Severity

NT-ware rates the severity level of this vulnerability as medium and the likelihood is low.

  • Exploitable configuration is not default and not fully adopted in the field.

  • Local administrator rights to the ULM RUI needs to be first entered.

  • CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N     Base Score: 4.8

Affected Versions

Product

Affected versions

uniFLOW Universal Login Manager

  • 5.10 and earlier.

  

Fixed Versions

Product

Fix versions

uniFLOW Universal Login Manager

  • 5.11 and later.

 

What You Need to Do

If you are running ULM in standalone mode and have it configured to your company LDAP server, it is recommended you update to a fixed version by following the instructions in the ULM manual.

  • uniFLOW Embedded Applet for MEAP

  • Reach out to your Canon or Canon Business Partner if you require further support with the upgrade instructions.

Mitigation

Disconnect ULM from the company LDAP server, (please discuss this action with your Canon supporter before taking this action as it might adversely impact the usability of the applet.

Support

If you have further questions, please contact your Canon / Canon Business Partner representative.