CVE-2026-54801
Last modified
CVE-2026-54801 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API.
Description
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Siemens | CPCI85 Central Processing/Communication | < V26.20 |
| Siemens | SICORE Base system | < V26.20.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-54801?
How severe is CVE-2026-54801?
How do I fix CVE-2026-54801?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-54786Wasmtime is a runtime for WebAssembly. All versions prior to…5
- CVE-2026-54787sigstore-go is a Go library for Sigstore signing and verific…3.1
- CVE-2026-5479In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryptio…8.1
- CVE-2026-54798A vulnerability has been identified in CPCI85 Central Proces…7.1
- CVE-2026-54799A vulnerability has been identified in CPCI85 Central Proces…8.4
- CVE-2026-54800A vulnerability has been identified in CPCI85 Central Proces…6.3
- CVE-2026-54802Unauthenticated Broken Authentication in SMS Alert Order Not…7.5
- CVE-2026-54803Subscriber Privilege Escalation in SMS Alert Order Notificat…9.8
- CVE-2026-54804Subscriber Broken Authentication in Melhor Envio <= 2.16.3 v…7.6
- CVE-2026-54805Subscriber Privilege Escalation in Falang multilanguage <= 1…8.8
- CVE-2026-54806Unauthenticated PHP Object Injection in WP Activity Log <= 5…9.8
- CVE-2026-54807Unauthenticated Privilege Escalation in Registration Form fo…9.8
Are you affected by CVE-2026-54801?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST