Mint Workbench I CVE-2026-19438

Requires LOCAL access to a host running ABB Mint Workbench I at version 5876 or earlier (AV:L) - this is the primary limiting factor and rules out remote/network exploitation. Per the CVSS vector, no privileges (PR:N) and no user interaction (UI:N) are needed once local access is obtained, meaning any local user context can trigger the traversal. The affected product is a specialized motion-control/servo commissioning application, so exposure is limited to engineering workstations and commissioning laptops rather than servers or internet-facing systems. The exact triggering feature (which file-path input accepts traversal) is not stated in the available data and should be confirmed from the ABB advisory.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, base 8.2) describes a LOCAL, low-complexity, unauthenticated path traversal yielding high confidentiality impact on both the vulnerable system (VC:H) and a subsequent system (SC:H), with no integrity or availability impact. The AV:L designation is the single most important risk-limiting signal: despite the 8.2 base score, this is NOT remotely reachable - an attacker needs local access to the host running Mint Workbench I. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so this is best treated as no public exploit identified at time of analysis. The vendor's inclusion of SC:H (subsequent-system confidentiality) inflates the score and is questionable for a standalone Windows engineering/commissioning tool; if the traversal only reads files within the same host's trust boundary, SC:N would be more defensible, dropping the real severity. Bottom line: a legitimately-scored path-traversal file-read that is meaningfully constrained by requiring local access, making it a moderate rather than urgent priority absent evidence of exploitation. Key data conflict to verify with ABB: the description gives no detail on which parameter or feature is traversable, and PR:N combined with AV:L implies any local user (even unprivileged) can trigger it - confirm against the advisory PDF.

A local user (or malware with unprivileged local execution) on a workstation running ABB Mint Workbench I supplies a crafted pathname (e.g. containing ../ sequences) to a file-handling function of the software, causing it to read files outside its intended directory and disclose their contents. No authentication or user interaction is required per the CVSS vector, but physical or interactive local access to the engineering host is a hard prerequisite. No public proof-of-concept is available at time of analysis.