How severe is CVE-2026-103548?

CVE-2026-103548 has a CVSS 4.0 base score of 5.3, rated medium severity.

Is CVE-2026-103548 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-103548?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-103548 published?

CVE-2026-103548 was published on 2026-09-30 and last updated on 2026-10-01.

CVE-2026-103548

CVE-2026-103548 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-257.

Key facts

Severity: Medium (CVSS 4.0 base score 5.3)
EPSS exploit prediction: 0% (1st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-257
Published: 2026-09-30
Last modified: 2026-10-01

Description

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.

Frequently asked questions

What is CVE-2026-103548?: Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
How severe is CVE-2026-103548?: CVE-2026-103548 has a CVSS 4.0 base score of 5.3, rated medium severity.
Is CVE-2026-103548 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-103548?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-103548 published?: CVE-2026-103548 was published on 2026-09-30 and last updated on 2026-10-01.

References

https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md

Other CWE-257 vulnerabilities

CVE-2025-8095 — Critical (CVSS 9.1): The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as…
CVE-2025-8904 — High (CVSS 8.5): Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/…
CVE-2025-34180 — High (CVSS 8.4): NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client,…
CVE-2025-6996 — High (CVSS 8.4): Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update…
CVE-2025-6995 — High (CVSS 8.4): Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update…
CVE-2016-15058 — High (CVSS 8.1): Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior…

Browse all CWE-257 vulnerabilities →