Which versions of 911 Emergency Gateway are affected by CVE-2026-6074?

Critical vulnerability in Intrado 911 Emergency Gateway systems (versions 5.x-7.x) enables unauthorized administrative access without credentials; no public exploit identified at time of analysis,…

How to fix or mitigate CVE-2026-6074?

Within 24 hours, inventory all Intrado EGW systems running versions 5.x, 6.x, or 7.x and immediately restrict network access to management interfaces using firewall rules; enable comprehensive debug logging on all management functions. Within 7 days, contact Intrado support to confirm patch timelines and request interim security guidance; implement network segmentation to isolate affected systems from general IT infrastructure and require VPN authentication for all remote administrative access. Within 30 days, establish automated daily configuration audits to detect unauthorized changes; monitor vendor security advisories for patch releases; implement 24/7 monitoring for access attempts and configuration modifications; develop contingency plans for systems that cannot be isolated; begin evaluation of upgrade paths or alternative vendor solutions if patching timeline extends beyond 90 days.

911 Emergency Gateway CVE-2026-6074

Q: What is the CVSS score of CVE-2026-6074?

CVE-2026-6074 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-25276 CRITICAL

Path Traversal: '.../...//' (CWE-35)

2026-04-23 icscert

GHSA-7v49-538c-cx3p

Path Traversal 911 Emergency Gateway

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network path traversal (PR:N/AV:N/AC:L/UI:N) yielding full read/modify/delete of files gives C:H/I:H/A:H; scope unchanged as impact stays within the appliance.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:36 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

9.3 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25276

CVE Published

Apr 23, 2026 - 18:14 nvd

CRITICAL 9.3

DescriptionCVE.org

A path traversal condition in Intrado 911 Emergency Gateway could allow an attacker with existing network access the ability to access the EGW management interface without authentication. Successful exploitation of this vulnerability could allow a user to read, modify, or delete files.

AnalysisAI

Authentication bypass via path traversal in Intrado 911 Emergency Gateway (EGW) versions 5.x, 6.x, and 7.x allows an attacker with existing network access to reach the EGW management interface without valid credentials and read, modify, or delete files. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but CISA's SSVC assessment rates the technical impact as total and the flaw as automatable, and the CVSS 4.0 base score is 9.3 (critical). EPSS probability is low (0.17%, 38th percentile), indicating no observed mass-exploitation activity yet.

Technical ContextAI

The affected component is Intrado's 911 Emergency Gateway (EGW), a telecom/public-safety appliance that routes and manages enhanced 911 (E911) emergency call traffic between enterprise phone systems and Public Safety Answering Points. The root cause is CWE-35 (Path Traversal: '.../...//'), a relative-path-traversal weakness in which crafted path sequences (e.g. '../') are not properly neutralized before being used to resolve file paths. In this case the traversal defeats access control on the web management interface, so an unauthenticated request can escape the intended directory scope and reach protected management functions and files. The single CPE identified is cpe:2.3:a:intrado:911_emergency_gateway:*, confirming the EGW application itself as the affected product.

RemediationAI

Consult the CISA ICS advisory ICSA-26-113-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-06) for Intrado's vendor-provided fixed release and apply the vendor-released update for your EGW 5.x/6.x/7.x branch; no exact fixed version number is provided in the available data, so the specific patch level must be confirmed from that advisory (No vendor-released patch version identified at time of analysis from the provided data). Because exploitation requires network reach to the management interface, the most effective compensating control is network segmentation and access restriction: place the EGW management interface on an isolated management VLAN, block inbound access to its web/management port from user and internet-facing networks, and permit administration only from a small allowlist of trusted management hosts or via VPN/jump host - trade-off is added operational friction for administrators and the need to update firewall/ACL rules. Additionally, front the interface with a reverse proxy or WAF that normalizes and rejects path-traversal sequences ('../', encoded variants), monitor management-interface logs for anomalous file access, and follow the general ICS defensive practices CISA references in the advisory; note that WAF filtering can be bypassed by novel encodings and is a stopgap, not a substitute for the vendor patch.