This vulnerability (CVE-2026-18783) is classified as CWE-306 (Missing Authentication for Critical Function) in Trex MES by Trex Digital Smart Manufacturing Systems Inc. It allows an attacker to bypass authentication mechanisms for critical functions within the product. The CVSS 3.1 score is 8.8, indicating high severity with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The affected versions include all versions up to and including 2026-09-29. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication controls on critical functions of Trex MES, potentially leading to full compromise of confidentiality, integrity, and availability of the system. This could result in unauthorized access and control over manufacturing processes managed by the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting network access to the affected system to trusted users and networks to reduce exposure.