NT OneAPP EUVD-2026-108004

Exploitation requires the NT OneAPP WebView to load content from an unvalidated source that raises an HTTP Basic Authentication challenge, and the target must be an already logged-in user who actively interacts with (responds to) that challenge - so the NUP Portal passcode is only disclosed if the victim supplies it. The description explicitly gates this on unspecified 'specific conditions' (reflected as AT:P), meaning it is not reliably reproducible against every deployment. Limiting factors: mandatory user interaction (UI:A), dependence on the victim being currently authenticated, and the undocumented triggering preconditions - these significantly narrow realistic exploitability despite the network, no-privilege vector.

This is a medium-severity (CVSS 4.0 base 5.9) credential disclosure flaw whose real-world risk is moderate and conditional rather than urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N) confirms a network-reachable, unauthenticated vector but materially constrains exploitation through two factors: AT:P signals that specific preconditions must be met ('under specific conditions' per the description), and UI:A requires the targeted logged-in user to actively interact. Impact is confined to confidentiality (VC:H) - the NUP Portal passcode of a victim - with no integrity or availability impact, so this is a credential-theft primitive, not direct code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data; per precision rules this is 'no public exploit identified at time of analysis.' The combination of unauthenticated network access but mandatory user interaction and non-default triggering conditions suggests opportunistic or targeted phishing-style abuse rather than mass automated exploitation. Net: a legitimate issue worth patching, but not a drop-everything priority absent evidence of active exploitation, which is currently absent.

An attacker lures a logged-in NT OneAPP user to a context where the app's WebView loads attacker-influenced content, triggering an HTTP Basic Authentication challenge sourced from an unvalidated origin. Because the user actively interacts with the prompt, the WebView surrenders the victim's NUP Portal passcode to the attacker-controlled endpoint. No public exploit code is identified at time of analysis, and the attack depends on specific triggering conditions plus user interaction.