CWE-1390 vulnerabilities

Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.

Weak authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.

Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally.

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application. The security update addresses the vulnerability by correcting the way that WER handles and executes files.

Weak authentication in Windows AppContainer allows an authorized attacker to disclose information locally.

Weak authentication in Windows App Readiness Service allows an authorized attacker to perform tampering locally.

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.

CVE-2026-107241 is a high-severity vulnerability in the Node.js web service of Versa VOS appliances used for Zero Touch Provisioning (ZTP). The service uses default credentials and HTTP Basic Authentication during initial provisioning, allowing an attacker with network access and knowledge of these credentials to perform provisioning actions. The vulnerability is mitigated by disabling the Node.js web service after provisioning, as recommended by Versa's security hardening guide. Devices with the service disabled are not vulnerable.

CVE-2026-107244 is a high-severity vulnerability in Versa VOS affecting certain versions. The Node.js web service used for Zero Touch Provisioning (ZTP) includes an endpoint (/decryptTest) that creates authenticated sessions based on a token decrypted with a hardcoded key and IV shared across all devices. This allows an unauthenticated attacker with network access to gain full authentication without credentials. The vulnerability is mitigated by disabling the Node.js web service after provisioning, as recommended by Versa's security hardening guide.

Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.

CVE-2025-30414 is a local privilege escalation vulnerability in Acronis Cyber Protect Cloud Agent and Acronis Cyber Protect 17 for Windows. It arises from weak authentication mechanisms allowing improper access. The issue affects versions before build 42569 for the Cloud Agent and before build 42587 for Cyber Protect 17. The vulnerability has a high severity rating with a CVSS score of 7.1.

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.

Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.