What is the CVSS score of CVE-2026-2101?

CVE-2026-2101 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of ENOVIAvpm Web Access are affected by CVE-2026-2101?

ENOVIAvpm Web Access users (versions 1.16-1.19) face a high-risk vulnerability that allows attackers to inject malicious scripts into user sessions, potentially compromising sensitive engineering…

How to fix or mitigate CVE-2026-2101?

Within 24 hours: Identify all systems running ENOVIAvpm versions 1.16–1.19 and restrict external access to the Web Access interface. Within 7 days: Implement WAF rules to block reflected XSS payloads, enforce Content Security Policy (CSP) headers, and disable Web Access if operationally feasible. Within 30 days: Monitor the vendor's security advisory for patch availability and plan immediate deployment upon release; evaluate migration to a patched version.

ENOVIAvpm Web Access CVE-2026-2101

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-16 3DS.Information-Security@3ds.com

XSS

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 16, 2026 - 17:18 nvd

HIGH 8.7

DescriptionCVE.org

A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session.

AnalysisAI

ENOVIAvpm Web Access versions 1.16 through 1.19 contain a reflected XSS vulnerability that allows authenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session through a crafted URL. The vulnerability requires user interaction to trigger but can lead to session hijacking, credential theft, or malware distribution across the affected organization. No patch is currently available, requiring organizations to implement network-level mitigations or restrict access until a fix is released.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session.

Affected ProductsAI

A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Re

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.