CVE-2026-89293highCWE-602CWE-862

CVE-2026-89293: fallo de gravedad alta en Eclipse Mnestix

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

Publicada el

Seguir esta CVE+ Monitorear Eclipse Mnestix

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.5%
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
Eclipse Foundation · Eclipse Mnestix
CVEs relacionadas — Eclipse Mnestix

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-89292CRITICALUnauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEPSS 0.5%CVE-2026-89295HIGHUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameterEPSS 0.2%