The vulnerability CVE-2026-65310 affects ANDRITZ HIPASE-250 (formerly 250 SCALA) where, in default configurations, critical data and configuration endpoints are accessible without authentication. Additionally, permissive Cross-Origin Resource Sharing (CORS) headers are present on every response, further increasing exposure. An attacker with network access can exploit this to read live process data and server configuration information. No authentication or user interaction is required, and the attack vector is network-based. There is no indication of integrity or availability impact, only confidentiality is affected.

An unauthenticated attacker with network access can read sensitive live process values and server configuration data from the affected device. This exposure can lead to information disclosure that may aid further attacks or unauthorized monitoring. There is no reported impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should restrict network access to the affected endpoints and consider disabling or securing the exposed interfaces until a patch or official guidance is available.