CVE-2026-44091

CriticalCVSS 9.1/10Last modified Jul 31, 2026

Description

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-501

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2026
Last modified
Jul 31, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-440929.1An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it feCVE-2026-440937.8A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary CVE-2026-440948.6An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including defaCVE-2026-440957.8A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commCVE-2026-440967.8A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full systCVE-2026-440977.1A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resuCVE-2026-440988.6This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS commandCVE-2026-440997.8A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, rCVE-2026-44107.5IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere ApplicaCVE-2026-441009.4The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of chargingCVE-2026-441019.8Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. CVE-2026-441025.3An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This w