Which versions of Wapt Server are affected by CVE-2026-33591?

Tranquil IT Wapt Server versions before 2.6.1.17813 allow unauthenticated remote attackers to obtain valid administrator session tokens, enabling complete takeover of the endpoint-deployment…

How to fix or mitigate CVE-2026-33591?

Within 24 hours: Inventory all Tranquil IT Wapt Server instances and assess network exposure; apply immediate firewall rules to restrict access to trusted administrative networks only, and consider taking internet-facing instances offline pending remediation. Within 7 days: Enable comprehensive audit logging for session creation and deployment approvals, review logs for any unauthorized access attempts or anomalous deployments, and establish manual approval workflows for software deployments as a temporary control. Within 30 days: Monitor Tranquil IT security advisories for release of patch version 2.6.1.17813 or later, conduct testing in a non-production environment immediately upon release, and schedule coordinated deployment to all affected servers within 48 hours of validation.

Wapt Server CVE-2026-33591

Q: What is the CVSS score of CVE-2026-33591?

CVE-2026-33591 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-52256 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-03 ENISA

GHSA-jj6f-hxj9-r997

Authentication Bypass Wapt Server

10.0

CVSS 4.0 · Vendor: ENISA

Severity by source

Vendor (ENISA) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network request yields a full session token (PR:N/UI:N/AC:L); compromising the deployment server extends to managed endpoints, so S:C with C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ENISA).

CVSS VectorVendor: ENISA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 10:30 vuln.today

CVE Published

Aug 03, 2026 - 09:35 cve.org

CRITICAL 10.0

DescriptionCVE.org

A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account.

AnalysisAI

Authentication bypass in Tranquil IT Wapt Server before 2.6.1.17813 lets a remote unauthenticated attacker send a specially crafted packet to obtain a valid session token for a targeted account, yielding full account takeover of the endpoint-deployment console. Because Wapt Server orchestrates software installation across managed endpoints, a stolen operator/admin session effectively grants control over the fleet it manages. Rated CVSS 4.0 10.0 with subsequent-system impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Wapt (by Tranquil IT Systems, cpe:2.3:a:tranquil_it_systems:wapt_server) is a software packaging and deployment platform used to push and manage applications, patches, and configuration to Windows/Linux/macOS endpoints from a central server - comparable in role to WSUS or SCCM. The flaw maps to CWE-288 (Authentication Bypass Using an Alternate Path or Channel): rather than exploiting a memory-corruption bug, the attacker reaches session establishment through a request path that does not enforce the normal authentication check, and the server returns a legitimate session token. The 'specially crafted packet' phrasing indicates the bypass is in how the server processes a specific request/protocol message during session handling, not in credential validation of the intended login flow.

RemediationAI

Vendor-released patch: upgrade Wapt Server to 2.6.1.17813 or later, per the Tranquil IT security bulletin (https://www.wapt.fr/en/doc/wapt-security-bulletin.html) and changelog (https://www.wapt.fr/en/doc/wapt-changelog.html#wapt-2-6-1-17813-2026-06-09). Until the upgrade is applied, restrict network reachability of the Wapt Server management interface: place it behind a VPN or firewall so only trusted management subnets can reach it, and remove any direct internet exposure - the trade-off is that remote or field endpoints may lose direct check-in until they connect through the VPN. Monitor server logs for anomalous session-token issuance and unexpected package-deployment jobs, and rotate/invalidate existing operator sessions after patching in case tokens were already harvested. Because this is an authentication bypass rather than a configurable feature, there is no reliable in-product feature toggle workaround - network isolation plus prompt patching is the actionable path.