CVE-2026-40434

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-940

Affected software

Vendor	Product	Versions
Anviz	Anviz CrossChex Standard	All versions

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.jsonThird Party Advisory
https://www.anviz.com/contact-us.htmlProduct
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03US Government Resource

Timeline

Published: Apr 17, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-404355.3When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Not CVE-2026-404367.5The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly CVE-2026-40443.8A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component CVE-2026-404469.8Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.This CVE-2026-404477.5Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115a CVE-2026-404485.3Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung O CVE-2026-404496.6Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source O CVE-2026-40453.7A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipu CVE-2026-404506.6Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption f CVE-2026-404515.1DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to e CVE-2026-404527.5Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-CVE-2026-404539.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandE