CVE-2026-11804

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11804", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "state": "PUBLISHED", "assignerShortName": "Honeywell", "dateReserved": "2026-06-09T15:04:29.906Z", "datePublished": "2026-07-23T15:07:42.043Z", "dateUpdated": "2026-07-23T18:16:05.366Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2026-07-23T15:07:42.043Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-280", "description": "CWE-280 Improper handling of insufficient permissions or privileges", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Tridium", "product": "Niagara Framework", "platforms": ["Windows", "Linux", "QNX"], "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Tridium", "product": "Niagara Enterprise Security", "platforms": ["Windows", "Linux", "QNX"], "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.<p>This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.</p>"}]}], "references": [{"url": "https://www.honeywell.com/us/en/product-security"}, {"url": "https://www.tridium.com/us/en/product-security"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Tridium recommends upgrading to one of the following versions:\n * Niagara Framework 4.14u6\n * Niagara Enterprise Security 4.14u6\n * Niagara Framework 4.15u5\n * Niagara Enterprise Security 4.15u5\n\n\nor applying the following patched modules\n\n * program-rt.jar version 4.14.5.22.1\n * program-rt.jar version 4.15.4.24.1", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Tridium recommends upgrading to one of the following versions:<br><ul><li>Niagara Framework 4.14u6</li><li>Niagara Enterprise Security 4.14u6</li><li>Niagara Framework 4.15u5</li><li>Niagara Enterprise Security 4.15u5</li></ul><div>or applying the following patched modules</div><div><ul><li>program-rt.jar version 4.14.5.22.1</li><li>program-rt.jar version 4.15.4.24.1</li></ul></div>"}]}], "credits": [{"lang": "en", "value": "Umut Pirkoca", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}, "title": "Program Module Vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T18:15:31.790870Z", "id": "CVE-2026-11804", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T18:16:05.366Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11804", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T18:15:31.790870Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T18:16:00.703Z"}}], "cna": {"title": "Program Module Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Umut Pirkoca"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tridium", "product": "Niagara Framework", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "unaffected"}, {"vendor": "Tridium", "product": "Niagara Enterprise Security", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Tridium recommends upgrading to one of the following versions:\n * Niagara Framework 4.14u6\n * Niagara Enterprise Security 4.14u6\n * Niagara Framework 4.15u5\n * Niagara Enterprise Security 4.15u5\n\n\nor applying the following patched modules\n\n * program-rt.jar version 4.14.5.22.1\n * program-rt.jar version 4.15.4.24.1", "supportingMedia": [{"type": "text/html", "value": "Tridium recommends upgrading to one of the following versions:<br><ul><li>Niagara Framework 4.14u6</li><li>Niagara Enterprise Security 4.14u6</li><li>Niagara Framework 4.15u5</li><li>Niagara Enterprise Security 4.15u5</li></ul><div>or applying the following patched modules</div><div><ul><li>program-rt.jar version 4.14.5.22.1</li><li>program-rt.jar version 4.15.4.24.1</li></ul></div>", "base64": false}]}], "references": [{"url": "https://www.honeywell.com/us/en/product-security"}, {"url": "https://www.tridium.com/us/en/product-security"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.", "supportingMedia": [{"type": "text/html", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.<p>This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE-280 Improper handling of insufficient permissions or privileges"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2026-07-23T15:07:42.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11804", "state": "PUBLISHED", "dateUpdated": "2026-07-23T18:16:05.366Z", "dateReserved": "2026-06-09T15:04:29.906Z", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "datePublished": "2026-07-23T15:07:42.043Z", "assignerShortName": "Honeywell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Framework", "vendor": "Tridium", "versions": [{"lessThan": "4.14.6", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.5", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Enterprise Security", "vendor": "Tridium", "versions": [{"lessThan": "4.14.6", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@honeywell.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5."}], "id": "CVE-2026-11804", "lastModified": "2026-07-23T19:16:51.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.2, "source": "psirt@honeywell.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11804", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T18:15:31.790870Z", "version": "2.0.3"}}]}, "published": "2026-07-23T16:17:13.273", "references": [{"source": "psirt@honeywell.com", "url": "https://www.honeywell.com/us/en/product-security"}, {"source": "psirt@honeywell.com", "url": "https://www.tridium.com/us/en/product-security"}], "sourceIdentifier": "psirt@honeywell.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-280"}], "source": "psirt@honeywell.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows", "linux", "qnx"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.14.6)"}}, {"platform": ["windows", "linux", "qnx"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.15.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Niagara Enterprise Security", "source": "cna", "vendor": "Tridium"}, "product": "niagara_enterprise_security", "vendor": "tridium"}, {"configurations": [{"platform": ["windows", "linux", "qnx"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.14.6)"}}, {"platform": ["windows", "linux", "qnx"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.15.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Niagara Framework", "source": "cna", "vendor": "Tridium"}, "product": "niagara_framework", "vendor": "tridium"}], "created": "2026-07-26T04:30:05.648768+00:00", "updated": "2026-08-03T21:30:05.079639+00:00", "vendors": ["tridium", "tridium$PRODUCT$niagara_enterprise_security", "tridium$PRODUCT$niagara_framework"]}