CVE-2026-2401
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
CWE-532 insertion of sensitive information into a log file can expose confidential data when a Web Admin user executes a malicious file provided by an attacker.
Risk Assessment
Confidential data may end up in logs accessible to unauthorized parties, increasing the risk of information leakage.
Recommendation
Restrict access to log files, apply the vendor patch, and avoid executing files from untrusted sources.
Other vulnerabilities in Web Admin
See all- CVE-2026-2405Medium
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
- CVE-2026-2403Medium
A CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerability allows a Web Admin user to alter the POST /logsettings request payload and cause Event and Data Log truncation, impacting log integrity.
- CVE-2025-11565High
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
Original NVD description (English source)
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS