CVE-2026-26418

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-26418", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-06T09:57:54.697Z", "dateReserved": "2026-02-16T00:00:00.000Z", "datePublished": "2026-03-05T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-05T16:11:16.484Z"}, "descriptions": [{"lang": "en", "value": "Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/aksalsalimi/cognix-recon-client-security-advisories"}, {"url": "https://github.com/aksalsalimi/CVE-2026-26418"}, {"url": "https://www.tcs.com/what-we-do/services/cognitive-business-operations/solution/cognix-platform-business-agility-enhanced-cx"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T09:56:47.766298Z", "id": "CVE-2026-26418", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T09:57:54.697Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-26418", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T09:56:47.766298Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T09:57:21.214Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/aksalsalimi/cognix-recon-client-security-advisories"}, {"url": "https://github.com/aksalsalimi/CVE-2026-26418"}, {"url": "https://www.tcs.com/what-we-do/services/cognitive-business-operations/solution/cognix-platform-business-agility-enhanced-cx"}], "descriptions": [{"lang": "en", "value": "Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-05T16:11:16.484Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26418", "state": "PUBLISHED", "dateUpdated": "2026-03-06T09:57:54.697Z", "dateReserved": "2026-02-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-05T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tcs:cognix_platform:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "B3E24A7D-397D-4E75-A986-D497380E092C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network."}, {"lang": "es", "value": "Falta de autenticaci\u00f3n y autorizaci\u00f3n en la API web de Tata Consultancy Services Cognix Recon Client v3.0 permite a atacantes remotos acceder a la funcionalidad de la aplicaci\u00f3n sin restricciones a trav\u00e9s de la red."}], "id": "CVE-2026-26418", "lastModified": "2026-06-17T10:26:10.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26418", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T09:56:47.766298Z", "version": "2.0.3"}}]}, "published": "2026-03-05T19:16:04.800", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/aksalsalimi/CVE-2026-26418"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/aksalsalimi/cognix-recon-client-security-advisories"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.tcs.com/what-we-do/services/cognitive-business-operations/solution/cognix-platform-business-agility-enhanced-cx"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.0"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "cognix_recon_client", "vendor": "tcs"}], "analysis": {"en": {"generated_at": "2026-04-16T13:02:10.783160+00:00", "value": {"mitigation_remediation": ["Update Cognix Platform to the latest version that includes proper authentication mechanisms for the web API, if such a release is available from TCS.", "If a patch is not yet available, limit network exposure by configuring firewall or reverse\u2011proxy rules to allow only trusted IP addresses to reach the web API endpoints, thereby reducing the attack surface.", "Implement access controls on the API layer, such as API keys or OAuth tokens, as an additional safeguard until a formal fix is applied."], "summary": {"action": "Apply Patch", "impact": "Unauthorized access to application functionality via the web API"}, "threat_synthesis": {"affected_systems": "This flaw affects the TCS Cognix Platform v3.0. No other versions or vendors are listed as impacted. If your deployment uses Cognix Platform 3.0, the web API endpoints are vulnerable.", "description_and_impact": "The vulnerability is a missing authentication and authorization check in the web API of TCS Cognix Recon Client v3.0. It allows an attacker who can reach the API over the network to invoke endpoint functionality without any form of credential verification. The result is that the attacker can exploit the application's logic without restriction, effectively bypassing all intended access control, which constitutes a significant confidentiality and integrity risk for the data handled by the solution.", "risk_and_exploitability": "With a CVSS score of 7.5 the vulnerability is classified as high severity. The EPSS score is less than 1%, indicating a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network, targeting the exposed web API. An attacker only needs network connectivity to the API services; authentication bypass will grant them unrestricted use of the functionality provided by those endpoints."}}}}, "created": "2026-03-06T15:18:07.659995+00:00", "title": "Unauthenticated Access in Cognix Recon Client Web API Allows Remote Functionality Exfiltration", "updated": "2026-04-16T13:15:06.219331+00:00", "vendors": ["tcs", "tcs$PRODUCT$cognix_recon_client"]}