Key points
- CVE-2026-86405 affects Sipay PrestaShop Virtual POS Module versions from 26.8.1 up to but not including 26.9.1.
- The vulnerability carries a CVSS score of 9.8, classified as critical severity.
- The flaw stems from improper verification of cryptographic signatures, categorized under CWE-347.
Security operations teams using the Sipay PrestaShop Virtual POS Module must assess their exposure to a newly disclosed critical vulnerability. The flaw, tracked as CVE-2026-86405, allows for signature spoofing due to improper validation of cryptographic signatures within the payment processing module. This issue impacts installations running version 26.8.1 through any version prior to 26.9.1.
By the numbers
- 9.8: The CVSS base score assigned to CVE-2026-86405, indicating critical severity.
- 26.9.1: The first version of the Sipay PrestaShop Virtual POS Module that resolves the vulnerability.
- 26.8.1: The earliest known affected version of the module.
What the figures mean
The high CVSS score reflects the severity of improper cryptographic verification. When a payment module fails to correctly validate signatures, it opens the door for attackers to manipulate transaction data. In the context of a Virtual POS module, this could allow an attacker to alter payment details or bypass security checks by forging valid-looking signatures. The vulnerability is rooted in CWE-347, which covers improper verification of cryptographic signatures. This weakness means the software accepts signatures that do not mathematically correspond to the data being signed, or accepts signatures from unauthorized keys.
For e-commerce platforms relying on Sipay for payment processing, this flaw undermines the integrity of financial transactions. The affected range is specific, covering versions starting from 26.8.1. Any deployment using a version older than 26.9.1 is considered vulnerable according to the National Vulnerability Database records.
What to watch
Security teams should monitor their PrestaShop environments for any signs of tampered transaction logs or unexpected payment confirmations. Since the vulnerability involves signature spoofing, attackers may attempt to exploit this to process fraudulent charges or manipulate order statuses. Teams should also keep an eye on vendor communications from Sipay Electronic Money and Payment Services Inc. regarding further disclosures or patches for adjacent components.
What to do and how to stay safe: Sipay
- Audit your PrestaShop installation to identify the current version of the Sipay Virtual POS Module.
- If running a version between 26.8.1 and 26.9.1, prioritize updating to version 26.9.1 or later once the vendor provides an update.
- Review transaction logs for anomalies that might indicate signature forgery or data manipulation.
- Implement additional monitoring on payment endpoints to detect unauthorized changes to transaction parameters.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Sipay PrestaShop module are vulnerable?
Versions from 26.8.1 up to, but not including, 26.9.1 are affected by CVE-2026-86405.
What is the impact of this vulnerability?
The flaw allows for signature spoofing through improper validation of cryptographic signatures, potentially compromising transaction integrity.
Is there a fix available?
Yes, updating to version 26.9.1 or later resolves the issue according to the NVD records.
