Talassoft CVE-2026-18931

Exploitation requires network access to a Talassoft Industrial Management Software instance running a version in the V.4-to-pre-V.16 range, plus knowledge of the hard-coded credential embedded in the software. Per the CVSS vector (PR:N/UI:N/AC:L), no prior authentication, no user interaction, and no elevated privileges are needed - the embedded credential itself is the access mechanism. The main limiting factors are that the target must be reachable on the network by the attacker (mitigated when the application is confined to an isolated OT/management segment) and must be an unpatched version below V.16; the shared static nature of the credential means once it is disclosed, all in-range deployments are exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact, yielding a 9.1 base score. However, the description scopes the actual effect to 'Retrieve Embedded Sensitive Data,' which is a confidentiality outcome - the I:H (integrity) rating in the input is not clearly supported by the description text and should be verified with the vendor. There is no EPSS score, no KEV listing, and no POC in the provided data, so the high CVSS reflects theoretical severity rather than demonstrated exploitation. Hard-coded credential flaws are typically reliable once the secret is known, so the primary risk gate is disclosure/reverse-engineering of the credential rather than exploit complexity; treat this as a genuine high-priority patch item for any organization running Talassoft, while recognizing the real-world exploitation footprint is limited by the product's niche deployment.

An attacker with network reachability to a Talassoft instance extracts the hard-coded credential - for example by reverse-engineering the client, reading configuration, or reusing a documented default - and authenticates to retrieve embedded sensitive data without any legitimate account. Given AV:N/AC:L/PR:N, no user interaction or prior access is required once the static secret is known. No public exploit is identified at time of analysis, so this reflects the described capability rather than observed in-the-wild activity.