FAST/TOOLS CVE-2026-11833

Q: What is the CVSS score of CVE-2026-11833?

CVE-2026-11833 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38411 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-06-23 YokogawaGroup

GHSA-4852-997v-4274

Information Disclosure Fast Tools Ci Server

8.2

CVSS 4.0 · Vendor: YokogawaGroup

Severity by source

Vendor (YokogawaGroup) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable web server discloses configuration without auth (PR:N/UI:N); AT:P in 4.0 maps to AC:H in 3.1; confidentiality-only impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (YokogawaGroup).

CVSS VectorVendor: YokogawaGroup

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jun 23, 2026 - 02:13 cve.org

HIGH 8.2

Analysis Generated

Jun 23, 2026 - 02:12 vuln.today

DescriptionCVE.org

Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This information could be exploited by an attacker for other attacks.

The affected products and versions are as follows:

FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04

CI Server (All packages) R1.01 to R1.04

AnalysisAI

Information disclosure in Yokogawa FAST/TOOLS (R9.01-R10.04) and CI Server (R1.01-R1.04) allows unmodified network attackers to retrieve CI Server configuration data via the embedded web server. The leaked settings can be leveraged as reconnaissance fuel for follow-on attacks against the SCADA/automation environment. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.

Technical ContextAI

FAST/TOOLS is Yokogawa's real-time SCADA/HMI platform (packages RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) widely used in industrial process control, and CI Server is its companion configuration interface component. The flaw maps to CWE-319 (Cleartext Transmission of Sensitive Information): the web server returns responses containing CI Server setting information without adequate protection, exposing internal configuration details to network-reachable clients. CPE coverage identifies cpe:2.3:a:yokogawa_electric_corporation:fast/tools and cpe:2.3:a:yokogawa_electric_corporation:ci_server as the impacted product lines.

RemediationAI

Patch status is not explicitly stated in the supplied data, so consult Yokogawa security advisory YSAR-26-0004-E at https://web-material3.yokogawa.com/1/39777/files/YSAR-26-0004-E.pdf for the vendor-provided fix package and apply it to all FAST/TOOLS R9.01-R10.04 and CI Server R1.01-R1.04 deployments. Until the patch is installed, restrict network access to the FAST/TOOLS and CI Server web interfaces using firewall ACLs or VLAN segmentation so that only authorized engineering workstations on the OT network can reach them (side effect: remote engineering and mobile HMIMOB access will be blocked and must be tunneled through a jump host or VPN), and place the web endpoint behind a reverse proxy that enforces TLS and authentication to mitigate the cleartext disclosure vector. Audit web server logs for unusual configuration-endpoint requests during the exposure window.