Digiwin's EasyFlow .NET V8.1.4 and earlier have two critical vulnerabilities: CVE-2026-12580 (Stored XSS, CVSS 5.4) and CVE-2026-12581 (Session
On June 22, 2026, the Taiwan Vulnerability Notification Platform (TVN) officially released the TVN-202606006 announcement, revealing that EasyFlow .NET process automation software contains two critical security vulnerabilities, corresponding to CVE-2026-12580 and CVE-2026-12581[2]. The vulnerability reporter is P.K. Hsu, the public date is 2026-06-22, and the affected products include all versions of EasyFlow .NET V8.1.4 (inclusive) and earlier[2]. The CVSS scores for these two vulnerabilities differ significantly: CVE-2026-12580 is rated 5.4 (Medium), while CVE-2026-12581 is as high as 7.5 (High), indicating that the latter poses a more serious threat to system security[2].
CVE-2026-12580 belongs to the Stored Cross-Site Scripting type, allowing authenticated remote attackers to inject persistent JavaScript code on specific pages; when users browse the page, the code executes automatically[2]. In contrast, CVE-2026-12581 is a Session Fixation vulnerability; if unauthenticated remote attackers can replace a user's Session ID, they can directly obtain the user's privilege once the user logs in[2]. If such vulnerabilities are maliciously exploited, they may lead to sensitive data leakage, account theft, or illegal system control, causing significant impact on enterprise process automation systems.
The technical mechanism of CVE-2026-12580 involves Stored Cross-Site Scripting, with the attack path being: an authenticated attacker exploits insufficient input validation on a specific page to inject persistent JavaScript code into the database or server storage area[2]. When other users browse the page, the browser automatically executes the injected code, leading to user-end manipulation or sensitive data theft[2]. The CVSS rating shows low attack complexity (AC:L), requires user interaction (UI:R), and has partial impact scope (C:L/I:L), thus rated as Medium[2].
CVE-2026-12581 is a Session Fixation vulnerability, with the core issue being that the system does not properly verify the source and integrity of the Session ID[2]. Attackers can, before the user logs in, replace the user's Session ID with one under their own control, so that after the user logs in, the system continues to use that Session ID, allowing attackers to directly obtain user privileges[2]. This vulnerability's CVSS score is 7.5 (High), due to high attack complexity (AC:H), no authentication required (PR:N), and full impact scope (C:H/I:H/A:H), indicating extremely high potential destructiveness[2]. If the system does not implement Session ID binding to IP or user behavior verification, this vulnerability will be easily exploited.
The common point of both vulnerabilities is that they involve flaws in the authentication mechanism, but the attack conditions differ: CVE-2026-12580 requires an authenticated attacker, while CVE-2026-12581 can be initiated by an unauthenticated party[2]. This difference indicates that EasyFlow .NET has multiple weaknesses in Session management and input validation, requiring a comprehensive review of its security architecture.
According to the Taiwan Vulnerability Notification Platform (TVN) announcement, the affected products are all versions of EasyFlow .NET V8.1.4 (inclusive) and earlier, covering a wide deployment environment of enterprise process automation systems[2]. This version range may include most outdated systems that have not been updated, especially posing higher risks for enterprises that do not perform regular maintenance. If the system does not implement enhanced authentication mechanisms, CVE-2026-12581 will allow unauthenticated attackers to easily steal user privileges, leading to sensitive data leakage or illegal system control[2].
CVE-2026-12580 affects authenticated users; if they browse a page injected with JavaScript, it may lead to account theft or sensitive data theft[2]. This vulnerability is particularly severe for enterprise internal process automation systems, as it may disrupt business processes or cause sensitive data leakage. Additionally, if the system does not implement Session ID binding, CVE-2026-12581 will allow attackers to easily steal high-privilege accounts, further expanding the impact scope[2].
In summary, both vulnerabilities pose extremely high security threats to enterprise process automation systems, especially for outdated systems that are not regularly updated, where risks are more significant. If enterprises do not patch promptly, it may lead to illegal system intrusion, data leakage, or business interruption, causing major impacts on enterprise operations.
It is recommended that all enterprises using EasyFlow .NET versions prior to V8.1.4 (inclusive) immediately update to V8.1.5 (inclusive) or later to fix the vulnerabilities[2]. This update includes security fixes for CVE-2026-12580 and CVE-2026-12581, effectively blocking attackers from exploiting insufficient input validation or Session management flaws to launch attacks[2].
Beyond version updates, enterprises should implement the following protection measures: First, strengthen authentication mechanisms, ensuring Session IDs are bound to user IP or behavior verification to prevent Session Fixation attacks[2]. Second, implement input validation and filtering to prevent persistent JavaScript code from being injected into the system, blocking Stored Cross-Site Scripting attacks[2]. Additionally, regularly monitor system abnormal behavior and conduct security audits to promptly detect and block potential attacks[2].
Enterprises should also establish a security risk management mechanism, regularly review system versions and security status, and ensure all systems are the latest versions. If an enterprise lacks the capability to update independently, it can contact relevant technical support teams for assistance to prevent vulnerabilities[2]. Finally, it is recommended that enterprises implement security education and training to enhance employees' awareness of security risks, reducing vulnerability exploitation caused by human negligence.