CVE-2026-22622

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-226237.2Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary c CVE-2026-226244.3Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without pro CVE-2026-226254.6Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files.CVE-2026-226264.9Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal devi CVE-2026-226278.8A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 ma CVE-2026-226286.7An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute syst CVE-2026-226293.7An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 CVE-2026-22635.3The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to CVE-2026-22649.2A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSR CVE-2026-226447.5Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, prox CVE-2026-226455.3The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity CVE-2026-226467.5Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attacke