CVE-2026-11804

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 4.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.honeywell.com/us/en/product-security
https://www.tridium.com/us/en/product-security

Configurations

No configuration.

History

23 Jul 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-23 16:17

Updated : 2026-07-23 19:16

NVD link : CVE-2026-11804

Mitre link : CVE-2026-11804

CVE.ORG link : CVE-2026-11804

JSON object : View

Products Affected

No product.

CWE

CWE-280

Improper Handling of Insufficient Permissions or Privileges

{"id": "CVE-2026-11804", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11804", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T18:15:31.790870Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 0.9}]}, "affected": [{"source": "psirt@honeywell.com", "affectedData": [{"vendor": "Tridium", "product": "Niagara Framework", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "unaffected"}, {"vendor": "Tridium", "product": "Niagara Enterprise Security", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "unaffected"}]}], "published": "2026-07-23T16:17:13.273", "references": [{"url": "https://www.honeywell.com/us/en/product-security", "source": "psirt@honeywell.com"}, {"url": "https://www.tridium.com/us/en/product-security", "source": "psirt@honeywell.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-280"}]}], "descriptions": [{"lang": "en", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5."}], "lastModified": "2026-07-23T19:16:51.933", "sourceIdentifier": "psirt@honeywell.com"}