EUVD-2026-68372
GHSA-wf77-f5jc-xpcv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Network-reachable forced-browsing requiring a low-privilege authenticated account; no availability impact is described in the CVE; C:H reflects sensitive operational log exposure.
Primary rating from Vendor (Nokia).
CVSS VectorVendor: Nokia
Lifecycle Timeline
5DescriptionCVE.org
WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser.
AnalysisAI
Privilege escalation in Nokia WaveSuite's CPB Log Files feature allows authenticated low-privilege users to access pages reserved for higher-privilege roles by directly navigating to their URLs, bypassing server-side role enforcement entirely. Affected versions confirmed by EUVD-2026-68372 include WaveSuite 23.6, 24.6, 24.12, and 25.6. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated WaveSuite session with at least low-privilege role assignment - unauthenticated access is not possible, and this cannot be exploited from the internet without first obtaining valid credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.6 (High) reflects a network-accessible flaw (AV:N) with low complexity (AC:L) requiring only a low-privilege authenticated account (PR:L) and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Nokia product security advisory at https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40463/ for official patch guidance; no specific fixed version number was independently confirmed from the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Nokia WaveSuite deployments and confirm which are running versions 23.6, 24.6, 24.12, or 25.6; review access logs for suspicious direct navigation to administrative URLs and role-based page access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today