Which versions of Panduit Intravue are affected by CVE-2026-50044?

Panduit IntraVUE industrial network visualization platform (versions 3.2.1a14 and prior) contains a credential theft vulnerability enabling attackers possessing administrator password hashes to gain…

How to fix or mitigate CVE-2026-50044?

Within 24 hours, inventory all IntraVUE deployments and identify systems running version 3.2.1a14 or earlier; immediately restrict administrative console access to a secured jump host and implement network-level isolation of IntraVUE systems from production environments. Within 7 days, rotate all administrator credentials to invalidate any captured password hashes, enable comprehensive audit logging of authentication attempts and administrative actions, and contact Panduit directly for interim hardening guidance pending patch availability per ICSA-26-204-04. Within 30 days, prioritize deployment of any vendor-released security patch upon availability; if Panduit provides no patch timeline, evaluate alternative industrial network visualization platforms or migrate to an air-gapped deployment model to eliminate remote access risk.

Panduit Intravue CVE-2026-50044

Q: What is the CVSS score of CVE-2026-50044?

CVE-2026-50044 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-48448 HIGH

Inadequate Encryption Strength (CWE-326)

2026-07-23 icscert

GHSA-6rv9-fwg5-8g8w

Information Disclosure Panduit Intravue Pronetiqs

7.6

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.6 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-accessible but requires credential interception positioning (AC:H, AV:N); low-privilege prior access needed (PR:L); admin credential compromise yields full C:H and I:H with no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 23:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 23:22 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 23:22 NVD

6.8 (MEDIUM) 7.6 (HIGH)

Analysis Generated

Jul 23, 2026 - 22:48 vuln.today

DescriptionCVE.org

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.

AnalysisAI

Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically weak password hash, allowing an attacker who obtains the stored or transmitted hash to recover or replay administrator credentials via a pass-the-hash attack. The flaw affects the IntraVUE industrial network visualization platform and can yield full administrative access to the console. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vulnerability was coordinated through CISA ICS-CERT (advisory ICSA-26-204-04).