Hard-Coded Passwords, Broken HR Systems, and Why Your 'Off-the-Shelf' Software Might Be Handing Out Admin Access
Three vulnerability disclosures landed in the National Vulnerability Database in the 24 hours ending on the 11th of October 2026. They are not related to one another by vendor, product category, or geography. But they share a single, damning root cause: developers made shortcuts with credentials and authentication during build, shipped those shortcuts into production software, and in at least two cases did not respond when researchers told them about it.
That pattern matters more than any individual CVE score. It tells you something about a category of risk that UK small businesses are carrying right now, often without knowing it.
The HR System That Skips the Password Check Entirely
CVE-2026-108707 was published on the 11th of October 2026 with a CVSS score of 9.8. It affects Wukong_HRM through commit 186115e, described as an HR management platform.
The vulnerability is in a component called ParamAspect. The finding: unauthenticated attackers can call every HR API endpoint by omitting the AUTH-TOKEN header. Not by forging it. Not by cracking it. By not sending it at all.
What is accessible through those endpoints? Payslips. Salary history. Employee personal data. Attachments. Company-wide HR records, with the ability to modify or delete them.
Read that list again in the context of the UK General Data Protection Regulation. Salary information is personal data. Payslips are personal data. The combination of full name, employment details, and compensation history constitutes sensitive personal data under most interpretations of the legislation. A breach of this information carries mandatory ICO notification obligations and potential enforcement action.
The vendor was contacted ahead of disclosure. According to the NVD record, they did not respond in any way.
For UK businesses: if your HR software is cloud-hosted or accessible via an API, the question to ask your provider is not whether they take security seriously. The question is whether they can demonstrate that authentication is enforced at the API layer, not assumed.
The AI Platforms That Hand Out Admin Tokens
Two further vulnerabilities published on the 11th of October 2026 affect AI chat and agent platforms, and both follow the same pattern: credentials and cryptographic secrets committed to source code or configuration files, available to anyone who looks.
CVE-2026-108753 affects Agnaistic agnai through version 1.0.555. The vulnerability is in the self-host Docker Compose configuration, which sets a fixed admin password and a public JWT secret. The consequence: unauthenticated attackers can log in as administrator using the known password, or sign their own JSON Web Tokens with the hard-coded secret and the claim admin: true. That gives them the ability to impersonate users, reset passwords, and modify server configuration. CVSS score: 9.4.
CVE-2026-108860 affects BotSharp through version 5.2.0. The vulnerability is in the WebStarter application settings file, which commits the HMAC secret, issuer, and audience values needed to sign valid JWT bearer tokens. An unauthenticated remote attacker can use those committed values to forge tokens and impersonate any known user, including administrators, on routes protected by the Authorize attribute. CVSS score: 9.1.
Both of these platforms are in the AI agent and AI chat category. That category is being adopted rapidly by small businesses for customer service automation, internal tooling, and productivity workflows. The question for any business that has deployed a self-hosted AI platform in the last 18 months is straightforward: was that platform configured with default credentials, and have those credentials been changed?
The honest answer in many small business environments is: nobody checked.
Why Vendors Who Don’t Respond Are a Specific Problem
The NVD record for CVE-2026-108707 notes that the vendor was contacted early and did not respond. The same language appears in CVE-2026-108576, a CVSS 10.0 command injection vulnerability affecting TOZED X300 routers.
This is not incidental detail. It is a signal about vendor behaviour that carries direct implications for the businesses buying their products.
Responsible disclosure exists precisely because there is a window between a researcher discovering a vulnerability and an attacker independently finding it. Vendors who engage with that process produce patches. Vendors who do not leave users exposed for longer, sometimes indefinitely.
For UK small businesses buying software, especially from smaller vendors or open-source projects without commercial backing, this is a procurement question as much as a technical one. Does this vendor have a published security contact? Have they issued security advisories in the past? Do they patch when notified?
Those are questions your MSP or IT adviser should be able to answer before software is deployed. If they cannot, that is information worth having.
The Broader Pattern: Hard-Coded Credentials as a Category
Hard-coded credentials are not a new vulnerability class. They appear in the OWASP Top Ten. They are documented in NCSC guidance on secure software development. They are entirely preventable.
They persist because they are convenient during development and because the organisations shipping the software often do not face direct consequences when they are exploited. The consequences land on the businesses running the software.
For a 15-person professional services firm running a self-hosted HR platform and an AI customer service tool, the risk is concrete. A successful exploit of CVE-2026-108707 exposes every employee’s salary and personal data. A successful exploit of CVE-2026-108753 or CVE-2026-108860 gives an attacker administrative control over a platform that may have access to customer communications, internal documents, or API integrations with other business systems.
The ICO’s published guidance on security under UK GDPR requires that organisations implement appropriate technical measures to protect personal data. Running software with known, unpatched authentication bypass vulnerabilities is difficult to characterise as an appropriate measure.
How to Turn This Into a Competitive Advantage
For businesses in professional services, legal, financial, or healthcare-adjacent sectors: your clients increasingly ask about your security posture during procurement. Being able to demonstrate that you actively monitor vendor vulnerability disclosures, that you have a patch management process, and that you audit your software stack against known vulnerability databases is a concrete differentiator.
Most of your competitors cannot say any of that with confidence. The ones who can are capturing the clients who ask the question.
Cyber Essentials certification requires that software is patched within 14 days of a high-severity fix becoming available. Building a process that checks the NVD for your specific vendors on a regular basis is not just good practice; it is a certification requirement that demonstrably improves your security posture.
How to Sell This to Your Board
Three arguments, none of them speculative.
First, the legal exposure is real and quantifiable. A breach of employee salary and personal data through CVE-2026-108707 triggers ICO notification obligations. ICO enforcement action for failure to implement appropriate security measures has resulted in fines reaching hundreds of thousands of pounds for organisations that could not demonstrate they had taken reasonable steps. The question for the board is whether the cost of a vendor audit is larger or smaller than the lower bound of that exposure.
Second, this is a vendor management problem, not a technology problem. The vulnerabilities disclosed this week require no technical sophistication to exploit. They require only that an attacker knows the software is running. Your board already understands supplier risk in procurement contexts. Apply the same framework to software.
Third, the pattern is accelerating. AI and automation tools are being deployed into small businesses faster than security review processes have caught up. The two AI platform vulnerabilities published this week are unlikely to be the last. Establishing a review process now, before a breach, is categorically cheaper than establishing one after.
What to Do Next
This week:
-
Inventory your software stack. Ask your MSP or IT support for a list of every application running in your business, including cloud-hosted platforms, self-hosted tools, and anything deployed in the last 18 months. If you do not have that list, getting it is the first task.
-
Check each item against the NVD. The National Vulnerability Database at nvd.nist.gov allows free text search by product name. Search for each application on your list. If anything returns a critical or high-severity result published in the last 90 days, escalate immediately.
-
Ask specifically about default credentials. For every self-hosted platform on your list, ask your IT contact to confirm that default passwords have been changed, that any hard-coded credentials have been identified, and that JWT or API signing secrets are not taken from documentation or sample configuration files.
-
Verify your patch cycle. Cyber Essentials requires patching high-severity vulnerabilities within 14 days of a fix becoming available. Ask your MSP to confirm that patching for the platforms on your list is within that window. If they cannot confirm it, that is a conversation worth having in writing.
-
Review your HR platform specifically. Given the nature of the data exposed by CVE-2026-108707, if you use any HR platform that is API-accessible or cloud-hosted, contact the vendor directly and ask whether they have been affected by or have a response to authentication bypass vulnerabilities in their API layer. A vendor that cannot answer that question clearly is a vendor worth reconsidering.
None of these steps require a security budget. They require time and the willingness to ask direct questions of the people managing your technology.
Before you go: follow the show wherever you listen, and if it has been useful, leave a rating or a review. It takes two minutes and it genuinely helps other small business owners find the briefing. Drop a comment with your thoughts, and if you know someone running a business who would benefit from hearing this, send it to them directly.