CVE-2026-109812CWE-862broken-access-control

CVE-2026-109812

published October 16, 2026

CVSS
6.9
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00125 · 2.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-16T07:18Z
References (1)
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 16 OCT 02:54Z
    Missing Authorization on Secret Endpoints
    cvelistv5
  • 16 OCT 02:54Z
    Missing Authorization on Secret Endpoints
    cvelistv5