EUVD-2026-88360
GHSA-f2hh-xm3g-34hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed PMWeb web endpoint
-
ExploitSend crafted request to encryptionhelper.dll function
-
ExecutionTrigger unintended information disclosure
-
ImpactHarvest leaked sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the encryptionhelper.dll library within a network-reachable PMWeb v7.x/v8.x/v2025.x deployment; per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is required, and no non-default configuration is named. Limiting factors: PMWeb is an on-prem/hosted construction management application typically deployed behind corporate access controls, so real-world reachability depends on the instance being internet-exposed; impact is confined to confidentiality (VC:L) with no integrity or availability effect, and the precise data exposed is undocumented. |
| Impact | This is a genuinely low-priority issue despite the moderate 6.9 CVSS 4.0 score. The vendor vector (AV:N/AC:L/PR:N/UI:N) indicates trivially remote, unauthenticated access, but the impact is narrow: only VC:L (low confidentiality), with VI:N and VA:N - no integrity or availability impact. The 6.9 is driven by ease of access, not by consequence; a translated CVSS 3.1 base is roughly 5.3 (C:L only). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so all three exploitation signals are absent - no public exploit identified at time of analysis. The disclosure is VulDB-only with no corroborating vendor advisory (the vendor did not respond), so both the affected-version claim and the impact scope rest on a single source. The affected function is described only as 'unknown' inside encryptionhelper.dll, so the exact data exposed is not characterized. Net: real but minor information-disclosure risk, not an urgent priority. |
| Exploit ScenarioDerived | A remote attacker sends crafted requests to an internet-reachable PMWeb instance and interacts with functionality backed by encryptionhelper.dll to elicit sensitive information without authentication. No public proof-of-concept is referenced, and the exact data disclosed is not specified beyond a low confidentiality impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Information disclosure in PMWeb v7.x, v8.x, and v2025.x allows a remote, unauthenticated attacker to extract sensitive data by manipulating an unspecified function inside the encryptionhelper.dll library. The vulnerability was disclosed to the vendor, who did not respond, so no vendor-released patch has been identified at the time of analysis and no public exploit code was identified either. The confidentiality impact is limited (VC:L) with no integrity or availability effect, making this a low-priority issue in practice - real-world exposure depends on whether a given PMWeb instance is reachable from untrusted networks, since the product is normally deployed behind corporate access controls.
RemediationAI
No vendor-released patch has been identified at the time of analysis, and the vendor has not responded to the disclosure, so remediation must currently rely on compensating controls. The primary control is to remove untrusted network reachability: place PMWeb behind a VPN or an authenticating reverse proxy, or restrict inbound access to the application tier by IP allow-list, so that remote unauthenticated requests cannot reach the encryptionhelper.dll code paths - the trade-off is that legitimate remote and mobile users lose direct access and must route through the VPN. If external exposure is business-required, terminate TLS at a WAF and apply rules that flag or block requests which trigger the affected helper functionality, accepting that signature coverage is speculative given the function is undocumented. Restrict filesystem permissions on encryptionhelper.dll and the web root so that only the PMWeb service account can read them, reducing the chance that any leaked path or key material can be chained further. Because the disclosed data type is unknown, also force rotation of PMWeb service credentials and any secrets stored in the application's configuration after exposure is suspected. Monitor the VulDB references (https://vuldb.com/vuln/410955 and https://vuldb.com/cve/CVE-2026-101083) for an eventual vendor fix, and escalate directly with PMWeb support to obtain a patch commitment and a definitive affected-version list.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is encryptionhelper.dll, a native Windows library that PMWeb uses to encapsulate its cryptographic helper routines - typically key handling, symmetric encryption/decryption wrappers, and hashing utilities exposed to the application's web tier. The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): an unspecified exported function returns or leaks data that should remain internal, rather than being a memory-safety or injection defect. Because the attacker path is remote and the CVSS 4.0 vector reports AV:N/AC:L/AT:N/PR:N/UI:N, no prior credential, no user action, and no non-default configuration are prerequisites according to the supplied metrics; the independent assessment concurs (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The published CPE (cpe:2.3:a:n/a:pmweb:*:*:*:*:*:*:*:*) does not pin a version, so the entire 7.x, 8.x and 2025.x lines should be treated as in scope until the vendor clarifies. The precise nature of the disclosed data - cryptographic material, tokens, or application records - is undocumented by the reporting source, which is a meaningful gap because it determines the true blast radius.
Know when Pmweb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remotely reachable with no auth or interaction per the reporter's vector; impact limited to a low-severity confidentiality leak, so C:L with I:N/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. Rated medium severity (CVSS 6.3), this v
A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Rated medium severity (CVSS 5.1), this vul
Path traversal in PMWeb 7.x, 8.x, and 2025.x lets unauthenticated remote attackers read files from the server filesystem
Exploit-DB