CVE-2026-7395CWE-306

CVE-2026-7395

published September 29, 2026

CVSS
8.5
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-29T14:17Z
References (1)
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000254&LanguageCode=en&DocumentPartId=&Action=Launch · [email protected]
EPSS history
Timeline
  • 30 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 29 SEP 09:45Z
    Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information…
    cvelistv5