This vulnerability (CVE-2026-57913) in the Johnson & Johnson Audit Tracking Management System is classified under CWE-602 (Client-Side Enforcement of Server-Side Security). It allows an attacker to view meeting minutes and transcripts by bypassing server-side security controls that are improperly enforced on the client side. The vulnerability affects versions of the product before 2026-04-21. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without authentication or user interaction, with a high impact on confidentiality but no impact on integrity or availability. No known exploits are reported in the wild, and no patch or remediation level has been disclosed by the vendor.

An attacker can remotely access sensitive meeting minutes and transcripts without any privileges or user interaction, leading to a high confidentiality impact. There is no impact on integrity or availability. This exposure of sensitive information could lead to unauthorized disclosure of confidential organizational data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor vendor communications for updates. Until a fix is available, restrict network access to the affected system where possible and consider additional access controls or monitoring to detect unauthorized access attempts.