What is the CVSS score of CVE-2026-57913?

CVE-2026-57913 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of J&J ATMS are affected by CVE-2026-57913?

Johnson & Johnson's Audit Tracking Management System (ATMS) contains an unauthenticated authorization bypass vulnerability (CVE-2026-57913) allowing remote attackers to access sensitive audit meeting…. A patch is available.

How to fix or mitigate CVE-2026-57913?

Within 24 hours: Inventory all ATMS deployments and confirm version dates; isolate any pre-2026-04-21 instances from untrusted networks pending remediation. Within 7 days: Implement network access restrictions (firewall rules limiting ATMS access to authenticated corporate networks); enable comprehensive audit logging and review 90-day access logs for unauthorized disclosure of audit records. Within 30 days: Contact Johnson & Johnson for patch availability and deployment timeline; evaluate alternative audit management systems or replacement of pre-April 2026 ATMS installations if vendor patch timeline exceeds risk tolerance.

J&J ATMS CVE-2026-57913

EUVD-2026-39644 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-26 mitre

GHSA-pxg7-h6wr-852q

Information Disclosure Audit Tracking Management System

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network read of protected audit data via missing server-side access control gives AV:N/AC:L/PR:N/UI:N with C:H and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 12:02 EUVD

Analysis Generated

Jun 26, 2026 - 11:21 vuln.today

DescriptionCVE.org

Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.

AnalysisAI

Unauthorized information disclosure in Johnson & Johnson's Audit Tracking Management System (ATMS) allowed remote attackers to view sensitive audit meeting minutes and transcripts without authentication in instances deployed before 2026-04-21. The flaw stems from client-side enforcement of access controls (CWE-602), meaning the server failed to verify authorization before returning confidential audit records. A public security research write-up by Eaton Works documents the issue, though no weaponized exploit or active exploitation (KEV) has been confirmed, and no public exploit code was identified at time of analysis.

Technical ContextAI

ATMS is a proprietary web application used by Johnson & Johnson to track internal audit activity, including the recording of meeting minutes and transcripts. The root cause is CWE-602 (Client-Side Enforcement of Server-Side Security): access restrictions that should be validated on the server were instead relied upon at the client, so a direct request for protected audit content succeeded when the client-side gate was bypassed or absent. The single CPE entry (cpe:2.3:a:johnson_&_johnson:audit_tracking_management_system) confirms this is a bespoke, vendor-hosted web application rather than a widely distributed software package, scoping the exposure to J&J's own deployment rather than third-party installations.

RemediationAI

The issue was addressed by the vendor as of 2026-04-21 (Patch available per vendor advisory; no released version number is published because ATMS is a vendor-hosted application), so any current J&J ATMS deployment should already enforce server-side authorization on meeting-minute and transcript retrieval. Organizations operating similar audit web applications should enforce server-side access-control checks on every endpoint that returns audit content rather than relying on client-side hiding (the CWE-602 root cause), restrict the application to authenticated and authorized sessions, and review access logs from before 2026-04-21 for unauthorized retrieval of minutes or transcripts; restricting the application's network exposure (VPN/IP allow-listing) is a useful compensating control with the trade-off of reduced accessibility for legitimate remote auditors. See the technical write-up at https://eaton-works.com/2026/06/24/jnj-webapp-hacks/.