SEPTEMBER 11, 2026
Live Feed
Back to database
Case File

CVE-2026-36035

MEDIUM · CVSS 6.5 EPSS 0.29%

Source: NVD + CISA KEV + EPSS · Published 2026-07-14 · Last synced 2026-08-13

CyberRota Analysis

AI-Generated

The /api/License/deactivateOffline endpoint in CAXPerts UniversalPlantViewer WebServices Server v2.7.6 is vulnerable due to incorrect access control, enabling authenticated attackers with low-level privileges to remove the license from the web server. This can lead to a Denial of Service (DoS) condition, disrupting service availability. Organizations using this version of the software should prioritize remediation to mitigate potential service interruptions.

CVE
CVE-2026-36035
Severity
MEDIUM
CVSS
6.5
EPSS
0.29%

Original NVD Description

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the license from the webserver.