CVE-2026-14948CWE-532

CVE-2026-14948

High · published August 20, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00571 · 46.6th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-08-20T13:16Z
References (1)
https://www.certvde.com/en/advisories/VDE-2026-078/ · [email protected]
EPSS history
Timeline
  • 20 AUG 08:19Z
    Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archives
    cvelistv5