OTTO Fleet Manager Weak Password Hashing Configuration Vulnerability (CVE-2026-7512)

Vulnerability Overview Vulnerability Name: OTTO® Fleet Manager – Weak Password Hashing Configuration CVE ID: CVE-2026-7512 Severity: Moderate Release Date: August 19, 2026 Last Updated: August 19, 2026 Revision: 1.0 Known Exploited Vulnerability (KEV): No Fixed: Yes Workarounds: No Affected Products Affected Product: OTTO® Fleet Manager Affected Software Versions: V2.36.2 and earlier Fixed Software Versions: 2.36.3 and later Affected Part Numbers: 029783, 029764, 030100, 029786, 029787 Remediation Enable Encrypted System Backup Description: OTTO® Fleet Manager now supports encrypted system backups (starting from version 2.36.3). Configure this using a user-selected passphrase. Initial Installation: During the initial configuration process, enter a passphrase to encrypt system backups. Reconfiguration/Upgrade: Changing the passphrase requires re-executing the cluster setup. - If no passphrase was previously set, a basic passphrase configuration screen will be displayed. - If a passphrase was previously set, the following options will be presented: - Keep: Retain the existing passphrase (no changes) - Change: Set a new passphrase; the same passphrase must be re-entered to confirm the configuration - Clear: Remove the passphrase and disable backup encryption Workarounds Enable Encrypted System Backup: Follow the steps above to enable encrypted system backups, preventing password hashes in unencrypted system backups from being targeted by offline brute-force attacks. Additional Information CVSS 3.1 Base Score: 6.8/10 CVSS 4.0 Base Score: 6.8/10 CWE: CWE-918: Using Password Hashing with Insufficient Computational Effort Known Exploited Vulnerability: No Summary This vulnerability involves a weak password hashing configuration in OTTO® Fleet Manager, which may allow password hashes in unencrypted system backups to be subjected to offline brute-force attacks. Users are advised to upgrade to version 2.36.3 or later and mitigate this issue by enabling encrypted system backups.

Goal Reached Thanks to every supporter — we hit 100%!

OTTO Fleet Manager Weak Password Hashing Configuration Vulnerability (CVE-2026-7512)