CVE-2026-65310highCWE-306CWE-942

CVE-2026-65310: high-severity vulnerability in ANDRITZ HIPASE-250

Missing authentication and permissive CORS policy

Published

Follow this CVE+ Monitor 250 SCALA+ Monitor HIPASE-250

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
ANDRITZ · 250 SCALAANDRITZ · HIPASE-250
Related CVEs — ANDRITZ HIPASE-250

In the same product, most dangerous first.

CVE-2026-65311MEDIUMMissing authentication for logging-configuration endpointEPSS 0.5%CVE-2026-65313HIGHUse of hard-coded VNC credentials in the engineering-workstation provisioningEPSS 0.3%CVE-2026-65309HIGHStorage of passwords in a reversible formatEPSS 0.2%