Is there a patch available for EUVD-2026-18841?

Yes, a patch is available for EUVD-2026-18841. Update the affected software to the latest version immediately.

Cloud Api EUVD-2026-18841

Q: What is the CVSS score of EUVD-2026-18841?

EUVD-2026-18841 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-28767 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-03 icscert

GHSA-v4x2-mqq5-6xqv

Authentication Bypass Cloud Api

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.12.2026

EUVD ID Assigned

Apr 03, 2026 - 20:45 euvd

EUVD-2026-18841

Analysis Generated

Apr 03, 2026 - 20:45 vuln.today

CVE Published

Apr 03, 2026 - 20:18 nvd

MEDIUM 6.9

DescriptionCVE.org

A specific administrative endpoint notifications is accessible without proper authentication.

AnalysisAI

Unauthenticated attackers can access administrative endpoint notifications in Gardyn Cloud API without proper authentication, allowing information disclosure via an authentication bypass vulnerability. The CVSS 6.9 score reflects the network accessibility and lack of required privileges, though impact is limited to confidentiality. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in Gardyn Cloud API administrative endpoints that handle notifications, stemming from insufficient authentication controls classified as CWE-306 (Missing Authentication for Critical Function). The affected product is Gardyn Cloud API across multiple versions. The root cause involves an administrative endpoint that should require authentication to access sensitive notification data but does not enforce credential validation, allowing an unauthenticated remote attacker to directly access this functionality over the network without elevated privileges or user interaction.

RemediationAI

Organizations should immediately apply the security update provided by Gardyn for Cloud API to address the authentication bypass. Specific patch version numbers are not independently confirmed in the provided data; consult https://mygardyn.com/security/ and https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 for exact remediation guidance and patched version numbers. As an interim mitigation, restrict network access to administrative endpoints via firewall or API gateway rules to limit exposure to trusted administrative networks only. Verify that all Cloud API instances require valid authentication credentials before accessing any notification or administrative endpoints.