Opcenter X EUVD-2026-43650

No special conditions - remote unauthenticated exploitation against default configurations of Opcenter X versions prior to V2604, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only concrete prerequisite is network reachability of the Opcenter X application's authentication/JWT-consuming endpoint; the flaw lies in how the application validates the JWT 'alg' header, requiring no valid credentials, no user interaction, and no non-default setting. The practical limiting factor is exposure: because Opcenter X is a manufacturing operations platform typically deployed inside OT/enterprise networks, exploitation requires the attacker to reach the instance, so instances confined to segmented internal networks are less exposed than internet-facing deployments.

This is a genuine top-priority issue, not a paper-high CVSS. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H is internally consistent with the description: fully remote, low complexity, no privileges, no user interaction, with a scope change (authentication subsystem compromise granting control of protected application resources) and total confidentiality/integrity/availability impact - hence the maximum 10.0. Authentication bypass leading to administrative impersonation is directly exploitable and automatable. The main tempering factor is exposure: EPSS is not provided, there is no KEV listing and no public POC identified at time of analysis, so exploitation is not confirmed in the wild. However, JWT alg-confusion flaws are well-understood and quick to weaponize once details are public, and reachability depends on whether the Opcenter X instance is internet-exposed or confined to an OT/manufacturing network. No signals conflict here; the primary unknown is real-world exposure and exploitation activity.

An attacker who can reach the Opcenter X web interface crafts a JWT with an administrator's identity claims and manipulates the header algorithm (e.g., setting 'alg' to 'none' or forcing HMAC verification against a known public key), producing a token the server accepts as valid without a legitimate signature. Presenting this forged token, the attacker authenticates as an administrator and gains full control of the MES platform. No credentials, prior access, or user interaction are required (AV:N/AC:L/PR:N/UI:N); no public POC is identified at time of analysis, though the technique class is publicly documented.