ICS Service Proxy EUVD-2026-76746

Exploitation requires three concrete conditions to be simultaneously satisfied: (1) the attacker must hold a valid low-privileged authenticated account on the system (confirmed by PR:L in the CVSS 4.0 vector); (2) the attacker must possess the shared service credential associated with the alternate routing path - this is an additional prerequisite beyond the session credential and the primary practical limiting factor; and (3) the attacker must know the specific client-supplied header name and the value that triggers the alternate routing rule. Exploitation is bounded to integrity impact only: VC:N and VA:N in the CVSS 4.0 vector confirm no confidential data can be read and no availability disruption occurs via this vector alone. The vulnerability does not affect deployments where the routing layer selects authentication mechanisms exclusively based on server-controlled attributes (e.g., mutual TLS, endpoint path, source address). Default network-perimeter controls that prevent unauthenticated external access do not mitigate this flaw once a low-privileged account is compromised.

The CVSS 4.0 score of 7.1, driven entirely by VI:H with no confidentiality or availability impact, accurately scopes the risk to unauthorized privileged write operations. The PR:L requirement establishes a meaningful minimum barrier: the attacker must already hold a valid account. However, the additional prerequisite of the shared service credential narrows the attacker population further in well-managed environments - and widens it substantially in ICS deployments where shared credentials are common, long-lived, and informally circulated among operational staff. No EPSS score is provided and this CVE is not listed in CISA KEV; no public exploit code is identified at time of analysis. These absence signals are consistent with a newly disclosed advisory but are not confirmatory of low real-world risk. In OT contexts, VI:H translates to potential unauthorized modification of device configurations, control parameters, or operational logic, which can have safety and availability implications beyond CVSS scope metrics. Overall risk is moderate for enterprise IT analogues, moderate-to-high for ICS deployments with lax shared-credential hygiene.

An attacker holding a legitimate low-privileged account and aware of the shared service credential - such as an operator, contractor, or insider - sends an HTTP API request with the spoofed routing header set to the value that directs traffic to the alternate authentication path. The gateway routes the request to that path, the shared credential is accepted, and the attacker's session is granted the fixed elevated role, enabling invocation of privileged operations such as modifying device configurations or control parameters on the downstream ICS service. No exploit code is publicly available at time of analysis, but the attack requires only standard HTTP client tooling.