uniFLOW Online 2026.3 Fixes Legacy UI Session Retention
Tech GuruQuick Answer
NT-ware says it has globally deployed the uniFLOW Online 2026.3 fix for CVE-2026-92378 and that no customer installation action is required. The issue affects 2026.2 Legacy UI Reduced Function Login during a specific Service Offline Emergency Mode timing sequence, potentially giving the next person limited device access under the previous user's session. Confirm unusual device behavior with the service provider rather than attempting a local cloud-service package upgrade.
Confirm Scope And Apply The Supported Fix
What to do now: identify devices using Legacy UI Reduced Function Login and confirm service status through NT-ware or your Canon support representative. Record any unexpected retained sessions, with device and UTC timestamps but without document contents or credentials.
Source recheck: October 2, 2026 UTC. The vendor's September 23 advisory states the fix was globally deployed; tenant/device verification was not performed for this article.
Scope And Authority
| Product scope | NT-ware uniFLOW Online 2026.2 Legacy UI Reduced Function Login under the advisory's Service Offline Emergency Mode timing conditions |
|---|---|
| Advisory | CPE2026-055 |
| CVE | CVE-2026-92378 |
| Authoritative release date | 2026-09-23 07:00:00.000 UTC |
| Authority revision date | 2026-09-23 14:49:17.637 UTC |
| Affected versions | NT-ware uniFLOW Online 2026.2 Legacy UI Reduced Function Login under the advisory's Service Offline Emergency Mode timing conditions |
| Fixed version | uniFLOW Online 2026.3, released globally in September 2026 |
| CVSS base score | 4.1 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | NT-ware states it is not aware of active exploitation. The issue was found during a customer proof of concept; that is not evidence of exploitation in the wild. |
What Changed
The fault involves a delayed login timing out after the first user has logged out, leaving a Reduced Function Login option that a subsequent person can use as that prior user. NT-ware says the available functions are typically local copying; Secure Printing and Scan are not available through this mode. It also says Modern UI does not exhibit this issue. These limits matter: the notice is not a claim that all tenant data or all print functions become accessible.
What To Validate Now
- Inventory. Record tenant/service status, device identity, Legacy versus Modern UI, emergency-mode settings and reports of retained sessions.
- Establish applicability. Compare each deployment with the authority's affected-version statement: NT-ware uniFLOW Online 2026.2 Legacy UI Reduced Function Login under the advisory's Service Offline Emergency Mode timing conditions Do not infer applicability from product family or severity alone.
- Remediate. NT-ware reports the correction deployed globally in 2026.3 and requires no customer action. Ask the provider to investigate a tenant or device still showing the behavior; do not install an unrelated firmware package as a substitute.
- Validate. Confirm the provider's service state and ordinary login/logout behavior. Any emergency-mode acceptance test needs an approved non-production device and synthetic users, without creating an outage for shared printers.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
