How severe is CVE-2026-94493?

CVE-2026-94493 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-94493 being actively exploited?

It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.

How do I fix CVE-2026-94493?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-94493 published?

CVE-2026-94493 was published on 2026-09-22.

CVE-2026-94493

CVE-2026-94493 is a critical-severity vulnerability with a CVSS 3.x base score of 10.0. The underlying weakness is classified as CWE-287.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
CVSS v2: 10.0
CVSS v4: 9.3
Actively exploited: Not listed in CISA KEV
Weakness: CWE-287
Published: 2026-09-22
Last modified: 2026-09-22

Description

A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Frequently asked questions

What is CVE-2026-94493?: A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
How severe is CVE-2026-94493?: CVE-2026-94493 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-94493 being actively exploited?: It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
How do I fix CVE-2026-94493?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-94493 published?: CVE-2026-94493 was published on 2026-09-22.

References

Other CWE-287 (Improper Authentication) vulnerabilities

CVE-2026-83099 — Critical (CVSS 10.0): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode).…
CVE-2026-83059 — Critical (CVSS 10.0): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server).…
CVE-2026-83021 — Critical (CVSS 10.0): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported…
CVE-2026-83020 — Critical (CVSS 10.0): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized…
CVE-2026-71133 — Critical (CVSS 10.0): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).…
CVE-2026-76658 — Critical (CVSS 10.0): A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an…

Browse all CWE-287 (Improper Authentication) vulnerabilities →