What is the CVSS score of CVE-2026-26342?

CVE-2026-26342 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Vega33 Firmware are affected by CVE-2026-26342?

Tattile Smart+ devices in your organization are vulnerable to authentication bypass attacks due to tokens that do not expire properly, allowing attackers to maintain unauthorized access indefinitely.

Is there a public PoC exploit available for CVE-2026-26342?

Yes, a public proof-of-concept exploit is available for CVE-2026-26342. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-26342?

Within 24 hours: Inventory all Tattile Smart+, Vega, and Basic devices and isolate high-criticality units to air-gapped or restricted networks; document current firmware versions. Within 7 days: Implement network segmentation to limit device communication to essential systems only; enable enhanced logging for all device authentication attempts; rotate all administrative credentials. Within 30 days: Contact Tattile for patch availability timeline; evaluate replacement or upgrade options; conduct penetration testing on affected device access controls.

Vega33 Firmware CVE-2026-26342

CRITICAL

Insufficient Session Expiration (CWE-613)

2026-02-24 disclosure@vulncheck.com

Authentication Bypass Vega33 Firmware Basic Mk2 Firmware Axle Counter Firmware Vega53 Firmware Anpr Mobile Firmware Vega11 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 03:10 vuln.today

Public exploit code

CVE Published

Feb 24, 2026 - 20:27 nvd

CRITICAL 9.8

DescriptionCVE.org

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.

AnalysisAI

Persistent authentication token in Tattile ANPR cameras firmware 1.181.5 and prior. Authentication tokens never expire, enabling indefinite session reuse. PoC available.