Mender Enterprise Server CVE-2026-33552

Per the CVSS vector (PR:N), no authentication is required. However, the high attack complexity (AC:H) is a critical limiting factor: exploitation requires that the attacker successfully meet conditions beyond simple network access - the exact nature of these conditions (race condition, specific API state, particular configuration mode, or token handling edge case) is not disclosed in the available description. The scope is unchanged (S:U), meaning the flaw cannot be leveraged to pivot across tenants or components beyond the initially vulnerable boundary. Exploitation is limited to confidentiality impact only (C:L/I:N/A:N), restricting the value of a successful attack. Deployments with the Mender API exposed directly to the public internet face higher realistic risk than private, VPN-gated installations. The specific configuration or feature within Mender Enterprise Server that enables this access control bypass is not confirmed from available data - consult the vendor blog post for full disclosure details.

The composite risk profile is low. The CVSS base score of 3.7 reflects the high attack complexity (AC:H) and limited confidentiality-only impact (C:L/I:N/A:N), capping real-world severity despite the network-accessible attack vector. EPSS at 0.02% (5th percentile) independently corroborates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit code has been identified at time of analysis. The 'Privilege Escalation' tag and CWE-269 classification suggest a meaningful access control boundary is crossed, but the actual exploitable impact - limited read access with no write or denial-of-service - constrains the blast radius significantly. Organizations running Mender Enterprise Server in internet-exposed or multi-tenant configurations should still prioritize patching given the unauthenticated attack vector, but this does not represent an emergency out-of-band patching scenario under current intelligence.

A remote, unauthenticated attacker who can reach the Mender Enterprise Server API over the network engineers a request or interaction sequence that satisfies the high-complexity precondition - likely a specific timing, parameter, or state requirement - causing the server to bypass its access control check. The attacker successfully reads a limited set of confidential data they are not authorized to access, such as device metadata, tenant information, or access tokens, without triggering integrity changes or service disruption. No public proof-of-concept code exists at time of analysis, making opportunistic exploitation unlikely in the near term.