CVE-2026-4760 is a vulnerability classified under CWE-552 (Files or directories accessible to external parties) affecting CODRA's Panorama Suite, a widely used industrial control system (ICS) software for supervisory control and data acquisition (SCADA) and human-machine interface (HMI) applications. The flaw exists in the Panorama Web HMI component, where an attacker who knows the exact file paths can remotely gain read access to certain server files. This is possible because these files are accessible to the Servin process execution account, and the system lacks proper access control to prevent unauthorized file reads. The vulnerability affects multiple versions of Panorama Suite: 2022-SP1 (22.50.005), 2023 (23.00.004), 2025 (25.00.016), and 2025 Updated Dec. 25 (25.10.007). Each version requires specific updates (e.g., PS-2210-02-4079 for 2022-SP1) to remediate the issue. The vulnerability requires no authentication or user interaction, making it remotely exploitable over the network. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Red) indicates network attack vector, low attack complexity, no privileges or user interaction needed, and high confidentiality impact with no integrity or availability impact. No known exploits are currently in the wild, but the vulnerability poses a significant risk due to the sensitive nature of files potentially exposed and the critical environments where Panorama Suite is deployed. The vendor has published security bulletin BS-035 with detailed patch information and guidance.

The primary impact of CVE-2026-4760 is unauthorized disclosure of sensitive information stored in server files accessible via the Panorama Web HMI interface. This can lead to exposure of configuration files, credentials, or operational data critical to industrial control systems. Such information leakage can facilitate further attacks, including targeted intrusions, sabotage, or espionage against industrial environments. Since Panorama Suite is used in critical infrastructure sectors such as energy, manufacturing, water treatment, and transportation, the confidentiality breach could disrupt operations or compromise safety. The vulnerability does not directly affect system integrity or availability, but the information gained can be leveraged to mount more damaging attacks. Organizations worldwide relying on Panorama Suite for ICS/SCADA operations face increased risk of data breaches and operational exposure if unpatched. The ease of exploitation without authentication or user interaction increases the threat level, especially for internet-exposed or poorly segmented systems.

1. Immediately apply the vendor-provided patches corresponding to your Panorama Suite version as detailed in security bulletin BS-035. 2. Restrict file system permissions for the Servin process execution account to the minimum necessary, ensuring sensitive files are not accessible. 3. Implement network segmentation and firewall rules to limit access to the Panorama Web HMI interface only to trusted management networks. 4. Monitor web server logs and network traffic for suspicious access attempts to known sensitive file paths. 5. Conduct regular audits of file permissions and access controls on Panorama Suite servers. 6. Employ intrusion detection systems (IDS) tuned to detect anomalous file access patterns. 7. Educate operational technology (OT) security teams about this vulnerability and ensure rapid patch management processes are in place. 8. If possible, disable or restrict access to Panorama Web HMI interfaces from untrusted networks or the internet. 9. Maintain up-to-date backups of critical configuration and operational data to enable recovery if further compromise occurs.