This vulnerability (CVE-2026-11804) in Tridium Niagara Framework and Niagara Enterprise Security arises from improper handling of insufficient permissions or privileges (CWE-280). It affects versions prior to 4.14.6 and 4.15.5 on multiple operating systems including Windows, Linux, and QNX. The flaw allows privilege abuse, potentially enabling an attacker with some level of access to escalate privileges or perform unauthorized actions. The CVSS 3.1 base score is 5.2, with attack vector as adjacent network, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability allows privilege abuse due to improper handling of insufficient permissions or privileges. This can lead to unauthorized access or actions that compromise confidentiality significantly, with limited impact on integrity and no impact on availability. The attack requires high privileges and access from an adjacent network, limiting the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review and enforce strict privilege management and access controls to limit potential abuse. Monitor vendor communications for updates on patches or official mitigations.