CVE-2026-94293
9.8 CRITICALPublished 2026-10-06 · Updated 2026-10-06
AI risk analysis
- Summary
- The flaw allows unauthenticated attackers to modify and read sensitive data via PATCH and GET requests, posing a significant security risk.
- Exploitability
- Exploitation is relatively straightforward as no authentication is required, and attackers can target specific endpoints.
- Blast radius
- If exploited, the flaw could lead to unauthorized data modification and exposure, impacting system integrity and confidentiality.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Disable the affected PATCH and GET endpoints or restrict access to them to authenticated users only.
auth-bypassdata-exposureweb
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-63455
- HIGHCVE-2026-100608PoC
- CRITICALCVE-2026-105763PoC
- MEDIUMCVE-2026-48974PoC
- HIGHCVE-2026-48976PoC
- CRITICALCVE-2026-51867PoC
- HIGHCVE-2026-6079
- MEDIUMCVE-2026-61747PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.