What is the CVSS score of CVE-2026-10056?

CVE-2026-10056 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nx Witness VMS are affected by CVE-2026-10056?

Network Optix Nx Witness VMS versions prior to 6.1.2 contain a session hijacking vulnerability that allows unauthenticated remote attackers to gain full administrative control by exploiting a CORS…. A patch is available.

How to fix or mitigate CVE-2026-10056?

Within 24 hours: Audit all Network Optix Nx Witness deployments to identify systems running versions prior to 6.1.2 in Standard security mode; document current operator account usage and network exposure. Within 7 days: Implement network segmentation restricting REST API access to trusted sources, deploy Web Application Firewall rules to block cross-origin requests to API endpoints, enforce 15-30 minute session timeout policies, and conduct operator security awareness training on phishing and suspicious links. Within 30 days: No vendor-released patch identified at time of analysis; continuously monitor vendor advisories for patch release and execute immediate upgrade upon availability.

Nx Witness VMS CVE-2026-10056

EUVD-2026-33262 HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-05-29 NX

GHSA-r863-5pgm-c8g4

Microsoft Information Disclosure Cors Misconfiguration

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 29, 2026 - 10:01 EUVD

Analysis Generated

May 29, 2026 - 09:16 vuln.today

CVE Published

May 29, 2026 - 08:04 nvd

HIGH 7.5

DescriptionCVE.org

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authenticated user and perform Administrator Account Takeover via a malicious cross-origin web page visited by the victim. The High security mode is not affected.Workaround:

For existing installations running in Standard security mode, set Access-Control-Allow-Credentials to false via the REST API: PATCH /rest/v2/system/settings with body {"supportedOrigins": "null"}. Alternatively, select High security level during initial setup.

Solution:

Update to Nx Witness VMS version 6.1.2 or later, in which Access-Control-Allow-Credentials is set to false in the default Standard security configuration.

AnalysisAI

Administrator account takeover in Network Optix Nx Witness VMS before 6.1.2 allows remote unauthenticated attackers to hijack authenticated user sessions through a CORS misconfiguration in the REST API when the product runs in default Standard security mode on Linux or Windows. By luring a logged-in operator to a malicious cross-origin page, the attacker's site can read credentialed REST responses and steal the session token, achieving full administrative takeover; no public exploit identified at time of analysis, but the issue is trivially weaponizable given the well-understood CORS attack pattern.

Technical ContextAI

Nx Witness VMS is a video management system whose server component exposes a REST API (paths like /rest/v2/system/settings) used by browser-based clients. The underlying flaw is classified as CWE-942 (Permissive Cross-domain Policy with Untrusted Domains): when running in the default Standard security mode, the server returns Access-Control-Allow-Credentials: true together with an overly permissive Access-Control-Allow-Origin policy, so the browser allows arbitrary attacker-controlled origins to issue credentialed XHR/fetch requests and read the responses, including session tokens. The affected CPE is cpe:2.3:a:network_optix:nx_witness_vms across all versions prior to the fix. The High security mode hardens the supportedOrigins setting and is therefore not affected.

RemediationAI

Vendor-released patch: Nx Witness VMS 6.1.2, in which Access-Control-Allow-Credentials is set to false by default in Standard security mode; upgrading is the primary fix. For installations that cannot upgrade immediately, the vendor-supplied workaround is to issue PATCH /rest/v2/system/settings with body {"supportedOrigins": "null"} via the REST API, which forces Access-Control-Allow-Credentials to false and blocks credentialed cross-origin reads - note this will also break any legitimate browser integrations that rely on cross-origin credentialed calls, so test integrated dashboards/embeds first. Alternatively, on fresh deployments select the High security level during initial setup. Additional compensating controls: restrict the VMS REST interface to a management VLAN so operator browsers cannot be steered to attacker pages while authenticated, and enforce short session lifetimes so any stolen token has limited value. Full details: https://support.networkoptix.com/hc/en-us/articles/39254208939159-How-to-Enable-CORS-Validation.