CVE-2026-39349
Low
Description
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.
SeverityLow
CVSS2.7
Exploit probability—
ProductOrangehrm
PublishedApr 7, 2026
First seenApr 7, 2026
Weakness typeCWE-326CWE-326
How to fix
Update
- orangehrm orangehrm5.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| orangehrm orangehrm | 5.0 ≤ v < 5.8.1 | 5.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.