CVE-2026-65310CWE-306CWE-942

CVE-2026-65310

High · published July 31, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration

of affected versions, exposes its data and configuration endpoint

without any authentication and permissive CORS on every response. An

unauthenticated attacker with network access can read live process

values and server configuration.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00500 · 42.0th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2026-07-31T13:16Z
References (1)
https://www.andritz.com/ · [email protected]
EPSS history
Timeline
  • 31 JUL 07:26Z
    Missing authentication and permissive CORS policy
    cvelistv5