NT OneAPP CVE-2026-114219

Exploitation requires the NT OneAPP login flow that protects request contents with a static, hard-coded cryptographic key; the attacker must first obtain the encrypted login request traffic (interception/observation of the client-server exchange), after which the known key decrypts it to reveal plaintext credentials and device information. No authentication or user interaction is required (PR:N/UI:N), but the practical limiting factor is the need to capture the targeted login traffic, which is why the vendor rates attack complexity high (AC:H); it is not a blind, unauthenticated request against a default endpoint.

This is a genuine high-severity confidentiality issue rather than an inflated CVSS number, but it is not a top-of-queue emergency on current signals. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, 9.1) indicates a network-reachable, unauthenticated flaw, but the AC:H (high attack complexity) is important: the attacker must observe or intercept the encrypted login traffic before the hard-coded key is useful to decrypt it, so this is not a trivial one-shot remote hit. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or automated exploitation - on available data this is 'no public exploit identified at time of analysis.' The CWE-798 (hard-coded cryptographic key) root cause is reliable and reproducible once the key is extracted from the client/firmware, which is the main reason to prioritize patching despite the AC:H dampener. One inconsistency to flag for verification: the input vector asserts VI:H (high integrity impact), yet the described mechanism is purely disclosure of credentials and device information - the integrity/account-takeover effect is a downstream consequence of stolen credentials, not a direct effect of this bug, so verify the integrity rating with the vendor. The 'Authentication Bypass' tag is also a loose fit for a credential-disclosure flaw.

An attacker positioned to capture NT OneAPP login traffic (e.g., on a shared/hostile network or via a passive tap) extracts the hard-coded cryptographic key that the application uses to protect login requests. Using that static key, the attacker decrypts captured login payloads and recovers users' plaintext account credentials and device information. No public exploit code was identified, and success depends on the attacker first obtaining the encrypted traffic (CVSS AC:H).