CVE-2026-26418: Tata Consultancy Services Cognix Recon Client · Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Given the absence of available patches, organizations should implement compensating controls immediately. These include restricting network access to the Cognix Recon Client web API using firewalls or network segmentation to limit exposure only to trusted internal systems. Employ VPNs or zero-trust network access solutions to enforce strong authentication at the network perimeter. Monitor network traffic for unusual access patterns to the API and deploy intrusion detection systems capable of flagging unauthorized requests. Engage with Tata Consultancy Services to obtain timelines for official patches and apply them promptly once released. Additionally, conduct thorough audits of data accessed via the application to identify any potential breaches. Where possible, disable or limit the use of the vulnerable API endpoints until a fix is available. Finally, educate security teams about this vulnerability to ensure rapid response to any suspicious activity.
Description
Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.