What is the CVSS score of CVE-2026-2331?

CVE-2026-2331 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-2331?

Within 24 hours: Inventory all AppEngine deployments and identify which versions are affected; immediately isolate or disable public HTTP access to AppEngine Fileaccess endpoints. Within 7 days: Implement network segmentation to restrict AppEngine traffic; deploy Web Application Firewall (WAF) rules to block suspicious file access patterns; conduct forensic analysis for signs of exploitation. Within 30 days: Monitor vendor communications for patch availability; develop and test remediation procedures; consider migration to patched versions or alternative services once available.

CVE-2026-2331

CRITICAL

Files or Directories Accessible to External Parties (CWE-552)

2026-03-06 psirt@sick.de

Information Disclosure Path Traversal

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 08:16 nvd

CRITICAL 9.8

DescriptionCVE.org

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.