Eclipse Milo EUVD-2026-52664

Q: What is the CVSS score of EUVD-2026-52664?

EUVD-2026-52664 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-63248 MEDIUM

Missing Authorization (CWE-862)

2026-08-04 eclipse

GHSA-xg6h-qgc7-qqr7

Authentication Bypass Eclipse Milo Eclipse Foundation

6.9

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable anonymous path requires no privileges (PR:N, AC:L); partial session credential disclosure (C:L) and unauthorized diagnostics enable (I:L); no availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 04, 2026 - 13:06 vuln.today

Analysis Generated

Aug 04, 2026 - 13:06 vuln.today

DescriptionCVE.org

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

AnalysisAI

Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without enforcing any authorization checks, a CWE-862 (Missing Authorization) flaw. An unauthenticated anonymous client connecting over a None/None (no-security) endpoint can enable the diagnostics subsystem with no certificate or credentials whatsoever; separately, a client presenting a trusted application certificate over SignAndEncrypt can read the SessionSecurityDiagnosticsArray for all active server sessions, harvesting usernames, login history, authentication mechanisms, session security modes and policies, and public client certificates. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the zero-authentication path and prevalence of None/None endpoints in legacy OT/IIoT environments meaningfully lower the exploitation barrier.

Technical ContextAI

Eclipse Milo (CPE: cpe:2.3:a:eclipse_foundation:eclipse_milo) is an open-source Java SDK implementing OPC Unified Architecture (OPC UA), the machine-to-machine communication standard widely deployed in industrial automation, SCADA, and IIoT systems. OPC UA defines a standardized server diagnostics model - including the SessionSecurityDiagnosticsArray node - that records per-session security metadata: usernames, session tokens, authentication mechanisms, security modes (None/Sign/SignAndEncrypt), security policies, and client application certificates. The root cause is CWE-862 (Missing Authorization): prior to the fix, the sdk-server module performed no access control checks when a client attempted to read this node or enable the diagnostics subsystem. The commit fix (a5dae1be0657d2b4fcb66e63f377c1dc36069e2a) introduces a new SessionSecurityDiagnosticsAccessMode enum - with RESTRICTED as the new safe default - wired into OpcUaServerConfig and OpcUaServerConfigBuilder; the absence of this enum in earlier versions confirms that all builds from 0.6.0 through 1.1.4 default to unrestricted access.

RemediationAI

Upstream fix is available as commit a5dae1be0657d2b4fcb66e63f377c1dc36069e2a in the Eclipse Milo GitHub repository (https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a); a tagged release version incorporating this patch has not been independently confirmed from the available references - operators must verify with the Eclipse Milo project (https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598) whether a patched release is available and upgrade to it. As an immediate compensating control for the anonymous diagnostics-enable vector, disable or restrict None/None (no message security) OPC UA endpoints - note this will break legacy clients lacking certificate support, so assess device compatibility before applying. For the trusted-certificate session-data disclosure path, audit and minimize the server trust store, removing any application certificates not strictly required; only clients with trusted certs can access SessionSecurityDiagnosticsArray. Network segmentation - firewall rules restricting OPC UA TCP/4840 to known-good client IP ranges - reduces exposure without application changes and is advisable regardless of patch status in OT/IIoT environments.