CVE-2026-94460— IRISPowerscan Insecure default privilege assignment for installation account
Quick assessment
Affected
I.R.I.S S.A. IRISPowerscan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IRISPowerscan 存在不安全的默认配置问题：其内置安装账户被赋予了高权限，且使用可预测的密码，这使得未经身份验证的攻击者能够未经授权访问该应用程序的受特权保护功能。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1110.001 · Password GuessingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| I.R.I.S S.A. | IRISPowerscan | ≤ 12.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94460
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IRISPowerscan Insecure default privilege assignment for installation account
Source: CVE Program / CVE List V5
Vulnerability Description
IRISPowerscan contain an insecure default
configuration where the built-in installation account is assigned elevated
privileges with a predictable password, which could allow an unauthenticated
attacker to gain unauthorised access to privileged application functionality.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
缺省权限不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| I.R.I.S S.A. | IRISPowerscan | 0 ~ 12.3 | - |
|
II. Public POCs for CVE-2026-94460
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94460
请登录查看更多情报信息。
Same Patch Batch · I.R.I.S S.A. · 2026-11-04 · 3 CVEs total
| CVE-2026-94459 | 7.2 HIGH | IRISPowerscan Default accounts with predictable credentials |
| CVE-2026-95649 | 6.1 MEDIUM | IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code executio |