What is the CVSS score of CVE-2026-26418?

CVE-2026-26418 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Cognix Platform are affected by CVE-2026-26418?

TCS Cognix Recon Client v3.0 contains a critical authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive application functionality without credentials.

How to fix or mitigate CVE-2026-26418?

Within 24 hours: Identify all systems running TCS Cognix Recon Client v3.0 and assess which contain sensitive data; isolate affected systems from production networks where possible. Within 7 days: Contact TCS for patch availability timeline and interim guidance; implement network segmentation to restrict API access to trusted internal networks only. Within 30 days: Deploy available patches or upgrades immediately upon release; conduct security audit of affected systems for signs of unauthorized access; implement WAF rules blocking unauthenticated API requests if patch delays persist.

Cognix Platform CVE-2026-26418

HIGH

Improper Access Control (CWE-284)

2026-03-05 cve@mitre.org

Authentication Bypass Cognix Platform

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 7.5

DescriptionCVE.org

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.

AnalysisAI

Cognix Platform's web API lacks authentication and authorization controls, enabling unauthenticated remote attackers to access restricted application functionality over the network. This vulnerability affects Tata Consultancy Services Cognix Recon Client v3.0 and poses a high risk due to its ease of exploitation and lack of authentication requirements. No patch is currently available.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects the web API of Tata Consultancy component of Cognix Platform. Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.