CVE-2026-0393 involves insufficient protection of credentials (CWE-522) in CODESYS Visualization 1.0.0.0. The vulnerability arises because authentication data is not properly isolated during concurrent login attempts by low privileged users within an active visualization session. This flaw can lead to remote exposure of credentials between users, potentially compromising authentication security. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and high impact on confidentiality. No patch or official remediation level has been provided by the vendor as of the publication date.

The vulnerability allows remote exposure of authentication credentials between low privileged users during concurrent login operations in the affected product. This could lead to unauthorized disclosure of sensitive credential information, potentially enabling further unauthorized access. However, the impact is limited to login operations within an active visualization session and does not affect other functionalities. There are no known exploits in the wild, and the severity is assessed as medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting concurrent login sessions for low privileged users or implementing additional network-level controls to limit exposure. Monitor vendor communications for updates on patches or official mitigations.