Refine your search
5 vulnerabilities found for by Scada-LTS
CVE-2026-84860 (GCVE-0-2026-84860)
Vulnerability from cvelistv5
Published
2026-09-16 14:52
Modified
2026-09-17 18:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass
Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body.
This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:36:47.898521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:37:14.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Scada-LTS",
"vendor": "Scada-LTS",
"versions": [
{
"status": "affected",
"version": "2.8.1"
}
]
}
],
"datePublic": "2026-09-16T14:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eScadaLTS 2.8.1-release-candidate build 0 is affected by an\u0026nbsp;Authorization Bypass\u003c/p\u003e\u003cp\u003e\u003cspan\u003eSpring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters \u003c/span\u003e\u003cspan\u003ec0-scriptName\u003c/span\u003e\u003cspan\u003e and \u003c/span\u003e\u003cspan\u003ec0-methodName\u003c/span\u003e\u003cspan\u003e. The \u003c/span\u003e\u003cspan\u003ecrossDomainSessionSecurity\u003c/span\u003e\u003cspan\u003e setting in \u003c/span\u003e\u003cspan\u003eweb.xml\u003c/span\u003e\u003cspan\u003e is set to \u003c/span\u003e\u003cspan\u003efalse\u003c/span\u003e\u003cspan\u003e, which disables DWR\u0027s built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. \u003c/span\u003e\u003cspan\u003eMiscDwr.initializeLongPoll.dwr\u003c/span\u003e\u003cspan\u003e) while targeting a restricted class in the POST body.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "ScadaLTS 2.8.1-release-candidate build 0 is affected by an\u00a0Authorization Bypass\n\n\n\nSpring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR\u0027s built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body.\n\n\n\nThis is the systemic root cause that enables multiple other findings to be exploited as a low privilege user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:52:23.502Z",
"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"shortName": "tenable"
},
"references": [
{
"url": "https://www.tenable.com/security/research/tra-2026-60"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Scada-LTS DWR Authorization Bypass - Systemic",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"assignerShortName": "tenable",
"cveId": "CVE-2026-84860",
"datePublished": "2026-09-16T14:52:23.502Z",
"dateReserved": "2026-09-02T13:26:23.692Z",
"dateUpdated": "2026-09-17T18:37:14.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84859 (GCVE-0-2026-84859)
Vulnerability from cvelistv5
Published
2026-09-16 14:52
Modified
2026-09-17 18:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection
The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users.
The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:37:34.735068Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:37:50.775Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Scada-LTS",
"vendor": "Scada-LTS",
"versions": [
{
"status": "affected",
"version": "2.8.1"
}
]
}
],
"datePublic": "2026-09-16T14:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eScadaLTS 2.8.1-release-candidate build 0 is affected by an\u0026nbsp;\u003cspan\u003eAuthenticated Blind SQL Injection\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThe \u003c/span\u003e\u003cspan\u003e/api/events/search\u003c/span\u003e\u003cspan\u003e endpoint accepts a JSON body containing a \u003c/span\u003e\u003cspan\u003esortBy\u003c/span\u003e\u003cspan\u003e array. The values in this array are concatenated directly into the SQL \u003c/span\u003e\u003cspan\u003eORDER BY\u003c/span\u003e\u003cspan\u003e clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThe endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via \u003c/span\u003e\u003cspan\u003ePOST /api/events/search\u003c/span\u003e\u003cspan\u003e as defined in \u003c/span\u003e\u003cspan\u003espring-security.xml\u003c/span\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "ScadaLTS 2.8.1-release-candidate build 0 is affected by an\u00a0Authenticated Blind SQL Injection\n\n\n\nThe /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users.\n\n\n\nThe endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:52:14.699Z",
"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"shortName": "tenable"
},
"references": [
{
"url": "https://www.tenable.com/security/research/tra-2026-60"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Scada-LTS Authenticated Blind SQL Injection",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"assignerShortName": "tenable",
"cveId": "CVE-2026-84859",
"datePublished": "2026-09-16T14:52:14.699Z",
"dateReserved": "2026-09-02T13:26:21.570Z",
"dateUpdated": "2026-09-17T18:37:50.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84858 (GCVE-0-2026-84858)
Vulnerability from cvelistv5
Published
2026-09-16 14:51
Modified
2026-09-17 18:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass
The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:38:13.599510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:38:31.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Scada-LTS",
"vendor": "Scada-LTS",
"versions": [
{
"status": "affected",
"version": "2.8.1"
}
]
}
],
"datePublic": "2026-09-16T14:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eScadaLTS 2.8.1-release-candidate build 0 is affected by an\u0026nbsp;Authenticated Remote Code Execution via Scripting Sandbox Bypass\u003c/p\u003e\u003cp\u003eThe DWR \"DataSourceEditDwr\" class exposes the \"validateScript\" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.\u003c/p\u003e"
}
],
"value": "ScadaLTS 2.8.1-release-candidate build 0 is affected by an\u00a0Authenticated Remote Code Execution via Scripting Sandbox Bypass\n\n\n\nThe DWR \"DataSourceEditDwr\" class exposes the \"validateScript\" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:51:56.402Z",
"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"shortName": "tenable"
},
"references": [
{
"url": "https://www.tenable.com/security/research/tra-2026-60"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"assignerShortName": "tenable",
"cveId": "CVE-2026-84858",
"datePublished": "2026-09-16T14:51:56.402Z",
"dateReserved": "2026-09-02T13:26:19.179Z",
"dateUpdated": "2026-09-17T18:38:31.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19657 (GCVE-0-2026-19657)
Vulnerability from cvelistv5
Published
2026-08-12 19:14
Modified
2026-08-12 19:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Summary
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T19:26:36.584772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:26:44.481Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ScadaLTS",
"vendor": "SCADA-LTS",
"versions": [
{
"status": "affected",
"version": "2.7.8.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Derrie Sutton, Tenable Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ScadaLTS 2.7.8.1\u0026nbsp;reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim\u0027s browser session."
}
],
"value": "ScadaLTS 2.7.8.1\u00a0reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim\u0027s browser session."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:14:33.647Z",
"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"shortName": "tenable"
},
"references": [
{
"url": "https://www.tenable.com/security/research/tra-2026-55"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ScadaLTS Unauthenticated Reflected XSS",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"assignerShortName": "tenable",
"cveId": "CVE-2026-19657",
"datePublished": "2026-08-12T19:14:33.647Z",
"dateReserved": "2026-08-12T18:52:24.033Z",
"dateUpdated": "2026-08-12T19:26:44.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19656 (GCVE-0-2026-19656)
Vulnerability from cvelistv5
Published
2026-08-12 19:10
Modified
2026-08-12 19:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19656",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T19:29:37.829898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:29:48.517Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ScadaLTS",
"vendor": "SCADA-LTS",
"versions": [
{
"status": "affected",
"version": "2.7.8.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Derrie Sutton, Tenable Research"
}
],
"datePublic": "2026-08-12T19:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ScadaLTS 2.7.8.1\u0026nbsp;exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system."
}
],
"value": "ScadaLTS 2.7.8.1\u00a0exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:15:19.400Z",
"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"shortName": "tenable"
},
"references": [
{
"url": "https://www.tenable.com/security/research/tra-2026-55"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ScadaLTS Authenticated Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"assignerShortName": "tenable",
"cveId": "CVE-2026-19656",
"datePublished": "2026-08-12T19:10:11.119Z",
"dateReserved": "2026-08-12T18:52:22.952Z",
"dateUpdated": "2026-08-12T19:29:48.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}