Which versions of SALTO ProAccess Space are affected by CVE-2026-11889?

SALTO ProAccess Space contains a privilege escalation vulnerability that breaks tenant isolation in multi-tenant deployments, enabling authenticated low-privileged users to access spaces and…. A patch is available.

How to fix or mitigate CVE-2026-11889?

Within 24 hours, audit all SALTO ProAccess Space deployments to identify systems with multi-tenancy enabled and document current tenant configurations, assigned user privileges, and logical partition assignments. Within 7 days, implement enhanced audit logging for all tenant-related object-reference manipulation and cross-tenant API calls, restrict administrative console access to senior security personnel only, and enforce principle-of-least-privilege access controls for low-privilege users to minimize their operational scope. Within 30 days, monitor SALTO Systems vendor advisories weekly for patch availability, contact the vendor for remediation timelines, and prepare a pre-production testing and staged deployment plan for the patch when released.

SALTO ProAccess Space CVE-2026-11889

Q: What is the CVSS score of CVE-2026-11889?

CVE-2026-11889 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45039 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-16 icscert

GHSA-4g4j-8g2w-gqh9

Authentication Bypass Privilege Escalation Proaccess Space

7.1

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Authenticated tenant user (PR:L) exploits an IDOR over the network (AV:N/AC:L/UI:N) to alter cross-tenant resources, giving integrity impact only (I:H, C:N/A:N), no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 16, 2026 - 22:19 EUVD

Analysis Generated

Jul 16, 2026 - 21:30 vuln.today

Severity Changed

Jul 16, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jul 16, 2026 - 21:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

CVE Published

Jul 16, 2026 - 20:38 cve.org

HIGH 7.1

DescriptionCVE.org

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product.

AnalysisAI

Privilege escalation in SALTO ProAccess Space access-control software allows an authenticated tenant user to break out of their assigned logical partition and reach any space managed by the platform. The flaw exists specifically when the multi-tenancy / logical partition feature is in use, letting a low-privileged authorized user manipulate an object reference to act on resources belonging to other tenants. Reported through CISA ICS-CERT (ICSA-26-197-07); no public exploit identified at time of analysis and no EPSS or KEV signal is provided in the input.

Technical ContextAI

SALTO ProAccess Space is management software for SALTO electronic access-control and door-locking systems, commonly deployed in commercial buildings, hospitals, hotels and multi-occupant facilities. Its tenancy / logical partition feature is designed to isolate distinct customers or organizational units so each administrator only sees and controls their own 'spaces' (doors, zones, users, credentials). The weakness maps to CWE-639, Authorization Bypass Through User-Controlled Key (an insecure direct object reference, IDOR): the application trusts a client-supplied identifier to determine which partition an operation targets without adequately verifying that the caller is entitled to that partition. As a result, tenant isolation - the core security boundary of the feature - can be crossed. CPE cpe:2.3:a:salto:proaccess_space:*:*:*:*:*:*:*:* is the only affected product identified, with no specific version bound in the supplied data.

RemediationAI

No vendor-released patch version is identified at time of analysis in the provided data; consult the CISA ICS advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-07) and its CSAF file (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-197-07.json) for the fixed release and vendor guidance, then upgrade ProAccess Space to that version once published. As compensating controls until patched, minimize the exposure of the tenancy / logical partition feature by reducing the number of low-privileged tenant accounts, tightly reviewing and revoking unnecessary operator credentials, and restricting network access to the ProAccess Space management interface to trusted administrative networks or VPN only (trade-off: may impede legitimate remote administration). Where feasible in multi-customer environments, monitor and audit cross-partition operations and consider consolidating or temporarily avoiding shared multi-tenant partitioning for highly sensitive facilities until the fix is applied (trade-off: operational overhead and loss of the isolation feature's convenience).