What is the CVSS score of EUVD-2026-42496?

EUVD-2026-42496 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of CAXperts UPVWebServices are affected by EUVD-2026-42496?

CVE-2026-35552 affects CAXperts UPVWebServices and UDiTH Portal, enabling users with standard limited privileges to deactivate application licenses and disable engineering services entirely.

How to fix or mitigate EUVD-2026-42496?

Within 24 hours: Identify and document all deployments of UPVWebServices (versions 2.4.2212.603-2.7.6) and UDiTH Portal (2026.0.0-2026.2.0); audit low-privilege user accounts and their access scope. Within 7 days: Implement network segmentation restricting low-privilege users from administrative API endpoints; remove administrative capabilities from standard accounts; enable comprehensive audit logging on license-control APIs. Within 30 days: Monitor vendor advisories for patch release; if unavailable, escalate for architectural mitigation or product alternative evaluation.

CAXperts UPVWebServices EUVD-2026-42496

| CVE-2026-35552 HIGH

Missing Authorization (CWE-862)

2026-07-08 cve@mitre.org

GHSA-h5xf-rv7f-wv3m

Authentication Bypass

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Authenticated low-privilege remote user (PR:L, AV:N, AC:L) abusing an unprotected endpoint; the actual impact is license deactivation causing service outage, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 16:43 vuln.today

CVSS changed

Jul 09, 2026 - 16:22 NVD

8.1 (None) 8.1 (HIGH)

CVE Published

Jul 08, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

AnalysisAI

Privilege-boundary bypass in CAXperts UPVWebServices (2.4.2212.603-2.7.6) and the companion UDiTH Portal (2026.0.0-2026.2.0) lets any authenticated low-privilege user reach an administrative API endpoint that lacks an authorization check, enabling them to deactivate the application's license and disable the service. Rated CVSS 8.1 by the reporter, this is a broken-access-control (CWE-862) issue affecting engineering-portal deployments. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV, though SSVC rates the technical impact as total.

Technical ContextAI

The affected software is CAXperts' plant/engineering visualization stack - UPVWebServices (the web-service backend that exposes UniversalPlantViewer data) and the UDiTH Portal front end. The root cause is CWE-862 (Missing Authorization): an administrative API endpoint performs authentication (the caller must be a valid logged-in user) but omits the server-side authorization step that should restrict the action to privileged/admin roles. As a result the endpoint trusts any authenticated session, and a horizontal/vertical access-control gap allows a standard user to invoke privileged functionality - here, the license-deactivation operation. The MITRE tag labels this 'Authentication Bypass,' but the description and CWE make clear it is more precisely an authorization (function-level access control) bypass performed by an already-authenticated user.

RemediationAI

Consult the vendor advisory CAXSEC-2026-001 (https://github.com/caxperts/security-advisories/blob/main/2026/CAXSEC-2026-001_portal.md) and upgrade to a fixed release above UPVWebServices 2.7.6 / UDiTH Portal 2026.2.0; note that no vendor-released patched version number was provided in the available data, so confirm the exact fixed build directly with CAXperts before deploying. Because exploitation requires an authenticated account, the most effective compensating control until patched is to tighten identity: restrict portal accounts to trusted users, enforce least privilege, and review who holds valid credentials. As a network-layer mitigation, place the UPVWebServices/UDiTH Portal API behind a reverse proxy or WAF and block or restrict access to the administrative license-management endpoint to admin source IPs or an internal management network - trade-off being that legitimate admin workflows must originate from those allowed paths. Additionally, monitor and alert on calls to the license-deactivation endpoint so that abuse is detected quickly given the outage impact.