Nx Witness VMS CVE-2026-10056

The target server must be Nx Witness VMS earlier than 6.1.2 running in the default Standard security mode on Linux or Windows with the REST API reachable from the victim's browser; High security mode deployments and installations already patched to 6.1.2+ are not exploitable. A logged-in administrator (or other privileged user with an active VMS session) must be tricked into visiting an attacker-controlled cross-origin page while that session is valid (CVSS UI:R), and the victim's browser must permit third-party/credentialed requests to the VMS origin - corporate browsers that strip third-party cookies, network segmentation that prevents the operator's browser from reaching the VMS host, or short-lived sessions all materially reduce exploitability. No attacker-side authentication is required (PR:N).

Real-world risk is moderate-to-high but gated by a victim-interaction requirement. The CVSS 7.5 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) is consistent with the description: network reachable, no authentication needed by the attacker, but the victim administrator must visit a malicious page while logged in, and AC:H reflects the need for a same-session timing/social-engineering element. Exploitation status is no public exploit identified at time of analysis, and the CVE is not on the CISA KEV list; EPSS data was not provided. Against that, the impact triad is high (full admin takeover of a security-critical surveillance platform), the attack class is well-known and easily reproduced from the advisory's workaround details, and Nx Witness deployments often expose REST interfaces to internal browser clients, so a phishing lure to an operator is realistic. No conflicting signals were observed between CVSS and the description.

An attacker phishes a Nx Witness administrator with a link to an attacker-controlled web page while the admin still has an active session in the VMS web client. The malicious page issues a credentialed cross-origin fetch to the victim's VMS REST API; because the server returns permissive CORS headers with Access-Control-Allow-Credentials: true, the browser delivers the response (including the session token / privileged data) back to the attacker's JavaScript, which exfiltrates it and uses it to take over the administrator account.