Which versions of mbCONNECT24 are affected by CVE-2026-10521?

mbCONNECT24 and mymbCONNECT24 contain a high-severity vulnerability enabling privileged users to bypass system safeguards and modify critical parameters, potentially compromising all operational data…. A patch is available.

How to fix or mitigate CVE-2026-10521?

Within 24 hours: Identify all systems running mbCONNECT24 or mymbCONNECT24; revoke administrative privileges from non-essential accounts; audit and document all current high-privilege users. Within 7 days: Contact MB connect vendor for available mitigations (reference advisory VDE-2026-068); no vendor-released patch identified at time of analysis; implement network segmentation isolating affected systems from critical infrastructure; enable comprehensive audit logging of all administrative actions. Within 30 days: Evaluate alternative product options or replacement timelines; establish vendor monitoring for patch release; develop insider-threat detection and incident response procedures for privilege escalation attempts.

mbCONNECT24 CVE-2026-10521

Q: What is the CVSS score of CVE-2026-10521?

CVE-2026-10521 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38422 HIGH

Direct Request ('Forced Browsing') (CWE-425)

2026-06-23 CERTVDE

GHSA-vwqx-9g89-x938

Information Disclosure Mbconnect24 Mymbconnect24

8.6

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable management endpoint with low complexity but requires existing high-privilege account (PR:H); full CIA impact on the portal, no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 09:16 EUVD

Analysis Generated

Jun 23, 2026 - 08:29 vuln.today

DescriptionCVE.org

An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.

AnalysisAI

Privileged remote modification of critical program parameters in MB connect line mbCONNECT24 and mymbCONNECT24 allows authenticated high-privilege attackers to reach a hidden configuration method that should be inaccessible to any user, resulting in total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue was coordinated through CERT@VDE under advisory VDE-2026-068.

Technical ContextAI

mbCONNECT24 and mymbCONNECT24 are remote-maintenance and industrial VPN portal products from MB connect line, widely used to provide secure remote access to OT/ICS equipment such as PLCs and HMIs. The flaw is classified as CWE-425 (Direct Request / Forced Browsing): an internal configuration endpoint is reachable directly by URL or API call without the platform enforcing that the function is off-limits, even to high-privileged accounts. Although high privileges are required to invoke it per the CVSS vector, the function itself was never intended to be exposed and bypasses the product's normal configuration governance, letting the caller alter critical operational parameters that would normally be locked down.

RemediationAI

Patch available per vendor advisory - operators should consult CERT@VDE advisory VDE-2026-068 at https://www.certvde.com/en/advisories/VDE-2026-068/ for the exact fixed mbCONNECT24 / mymbCONNECT24 build and upgrade to it; no specific fixed version is enumerated in the input data so do not assume a number. Until the patched version is deployed, compensating controls should focus on restricting who can authenticate as a high-privileged user: enforce MFA on all administrator accounts, prune unused admin and operator accounts, rotate admin credentials, and restrict management-plane access to the portal to a small set of source IPs via firewall or VPN allowlist so the hidden configuration method cannot be reached even by stolen credentials from arbitrary networks. Enable and monitor audit logs for configuration-change events and unexpected access to administrative endpoints; the side effect of the network restriction is reduced remote-admin convenience, and the side effect of credential restrictions is additional account-management overhead.