What is the CVSS score of EUVD-2026-48289?

EUVD-2026-48289 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-48289?

Yes, a patch is available for EUVD-2026-48289. Update the affected software to the latest version immediately.

Niagara Framework EUVD-2026-48289

| CVE-2026-11804 MEDIUM

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-07-23 Honeywell

GHSA-769r-j4hr-6567

Information Disclosure Microsoft Niagara Enterprise Security Niagara Framework Tridium

5.2

CVSS 3.1 · Vendor: Honeywell

Severity by source

Vendor (Honeywell) PRIMARY

5.2 MEDIUM

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

5.2 MEDIUM

Adjacent vector and PR:H both confirmed by exploitation preconditions; C:H reflects information disclosure of sensitive operational data with no availability impact.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Honeywell).

CVSS VectorVendor: Honeywell

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 23, 2026 - 18:04 EUVD

Analysis Generated

Jul 23, 2026 - 16:01 vuln.today

CVE Published

Jul 23, 2026 - 15:07 cve.org

MEDIUM 5.2

DescriptionCVE.org

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.

This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.

AnalysisAI

Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Tridium Niagara is a Java-based industrial IoT and building automation framework widely used in HVAC, lighting, energy management, and physical security systems. CWE-280 (Improper Handling of Insufficient Permissions or Privileges) indicates the framework fails to properly enforce permission boundaries when a user with high-level credentials attempts operations, allowing that role to exceed its authorized access. The affected CPE strings - cpe:2.3:a:tridium:niagara_framework and cpe:2.3:a:tridium:niagara_enterprise_security - confirm both the core operational framework and its enterprise security management layer are affected. The adjacent network attack vector (AV:A) implies exploitation requires the attacker to be on the same network segment, subnet, or logical broadcast domain as the Niagara controller or server, which is consistent with typical OT/BAS network topologies. The 'Microsoft' tag in the source intelligence may reflect tagging artifact and does not appear relevant to the vulnerability mechanics.

RemediationAI

Upgrade Niagara Framework and Niagara Enterprise Security to version 4.14.6 or 4.15.5 (or later in their respective branches) as confirmed in the CVE description. Vendor guidance is available at https://www.tridium.com/us/en/product-security and https://www.honeywell.com/us/en/product-security. Where immediate patching is not feasible, apply network segmentation to ensure Niagara controllers and servers are isolated on dedicated OT VLANs inaccessible from broader enterprise or guest networks, which directly mitigates the AV:A attack vector. Additionally, audit and reduce the number of accounts with high-privileged access to Niagara, enforce multi-factor authentication where supported, and monitor for anomalous data access patterns by privileged accounts. These compensating controls reduce but do not eliminate risk - patch deployment remains the authoritative fix.