ABB Ability Edgenius CVE-2026-13599

The available sources do not name a specific feature, protocol, or configuration setting that must be enabled; the description states only that a critical function in ABB Ability Edgenius (versions through 3.2.3.0) lacks authentication, and the exact function and trigger are not described in the available sources. Limiting factors drawn from the vendor CVSS vector: exploitation requires local access to the affected host (AV:L) rather than remote network reach, is rated high complexity (AC:H), and requires low-level privileges (PR:L) - though the CWE-306 missing-authentication classification suggests authentication may in fact not be required, which should be confirmed with ABB. No user interaction is needed (UI:N), and only versions up to and including 3.2.3.0 are affected.

ABB rates this CVE-2026-13599 at CVSS 7.8 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a locally-exploitable flaw with high attack complexity, requiring low-level privileges, no user interaction, a changed scope, and full high impact to confidentiality, integrity, and availability. There is a notable internal tension in the data: the weakness is classified as CWE-306 (Missing Authentication for Critical Function) and tagged 'Authentication Bypass', which normally implies no authentication is needed (PR:N), yet the vendor vector specifies PR:L and AV:L (local) - this should be verified with ABB, as missing-authentication flaws are frequently network-reachable and require no privileges. No EPSS probability is provided in the input, there is no CISA KEV listing, and no public exploit or PoC reference is present (the only reference is an ABB advisory document, not exploit code), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', placing it as a near-term patch priority rather than an emergency. On balance this is a genuinely high-severity flaw worth prompt remediation, but the local attack vector (AV:L) and high complexity (AC:H) in the vendor's own scoring, combined with the niche industrial deployment footprint and absence of known exploitation, suggest realistic risk is bounded to attackers who already have local/adjacent foothold on affected ABB Ability Edgenius systems rather than widespread opportunistic exploitation.

An attacker who has already obtained local access and some low-level privileges on a host running ABB Ability Edgenius (through 3.2.3.0) invokes a critical function that fails to enforce authentication, gaining unauthorized high-impact control that, due to the changed scope, extends beyond the vulnerable component. No public exploit code or PoC reference is present in the available data, and the vendor's own vector cites high attack complexity (AC:H), so exploitation is not trivial. Note the trigger mechanism and the exact 'critical function' affected are not described in the available sources.