DivvyDrive Open Redirect Vulnerability CVE-2026-6795 Rated Critical

The National Vulnerability Database (NVD) has detailed CVE-2026-6795, a critical URL redirection to untrusted site (‘open redirect’) vulnerability affecting DivvyDrive Information Technologies Inc. DivvyDrive. This flaw, present in versions from 4.8.2.9 before 4.8.3.2, allows for parameter injection, enabling attackers to craft malicious links that redirect users to arbitrary, untrusted websites.

Rated with a CVSS score of 9.6 (CRITICAL), this vulnerability carries significant risk. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H indicates it’s network-exploitable with low attack complexity, requiring user interaction (e.g., clicking a link), but leading to high confidentiality, integrity, and availability impacts. This is a classic phishing vector, where trust in a legitimate domain is leveraged to deliver malware or steal credentials.

Defenders need to understand the attacker’s calculus here: social engineering is cheap and effective. An open redirect turns a legitimate domain into a weaponized URL shortener. For organizations using DivvyDrive, patching is non-negotiable. This isn’t theoretical; this is how initial access often begins, leading to much larger incidents.