CVE-2026-34184CWE-862broken-access-control

CVE-2026-34184

Critical · published April 9, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database.

This issue was fixed in AlanWeb SCADA version 9.8.5

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-09T14:16Z
Affected products (1)
ProductVersionsFixed in
hydrosystem.poznan/control_system< 9.8.59.8.5
References (2)
https://cert.pl/posts/2026/04/CVE-2026-4901/ · [email protected]https://control-system.pl/ · [email protected]
EPSS history
Timeline
  • 09 APR 09:41Z
    Missing Authorization in Hydrosystem Control System
    cvelistv5