CVE-2026-41993
Last modified
CVE-2026-41993 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker needs to deploy unauthorized file on the removable media in advance. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker needs to deploy unauthorized file on the removable media in advance. This issue affects SafePortAgent: before 3.2.5024; StellarProtect: from 3.2.4011 before 5.0.1083.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TXOne Networks | SafePortAgent | < 3.2.5024 |
| TXOne Networks | StellarProtect | >= 3.2.4011, < 5.0.1083 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-41993?
How severe is CVE-2026-41993?
How do I fix CVE-2026-41993?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41988uuid before 14.0.0 can make unexpected writes when external …2.5
- CVE-2026-41989Libgcrypt before 1.12.2 sometimes allows a heap-based buffer…6.7
- CVE-2026-4199A vulnerability was identified in bazinga012 mcp_code_execut…5.3
- CVE-2026-41990Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes…4
- CVE-2026-41991GNU gzip contains a vulnerability in the gzexe utility relat…4.7
- CVE-2026-41992GNU gzip contains a global buffer overflow vulnerability in …7.5
- CVE-2026-41999Incorrect Behaviour of Views with TCP PROXY Requests4.8
- CVE-2026-4200A security flaw has been discovered in glowxq glowxq-oj up t…7.3
- CVE-2026-42000Insufficient Validation of Names During AXFR8.6
- CVE-2026-42001Insufficient Validation of Autoprimary SOA Queries7.5
- CVE-2026-42002Concurrency and locking defects in GSS-TSIG7.5
- CVE-2026-42004An attacker can send a crafted EDNS OPT record that will be …3.7
Are you affected by CVE-2026-41993?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST