{"api_version":"1","generated_at":"2026-07-24T01:58:40+00:00","cve":"CVE-2026-11804","urls":{"html":"https://cve.report/CVE-2026-11804","api":"https://cve.report/api/cve/CVE-2026-11804.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-11804","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-11804"},"summary":{"title":"Program Module Vulnerability","description":"Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.","state":"PUBLISHED","assigner":"Honeywell","published_at":"2026-07-23 16:17:13","updated_at":"2026-07-23 19:16:51"},"problem_types":["CWE-280","CWE-280 CWE-280 Improper handling of insufficient permissions or privileges"],"metrics":[{"version":"3.1","source":"psirt@honeywell.com","type":"Secondary","score":"5.2","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.2","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://www.honeywell.com/us/en/product-security","name":"https://www.honeywell.com/us/en/product-security","refsource":"psirt@honeywell.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.tridium.com/us/en/product-security","name":"https://www.tridium.com/us/en/product-security","refsource":"psirt@honeywell.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11804","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11804","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Tridium","product":"Niagara Framework","version":"affected 4.14.6 custom","platforms":["Windows","Linux","QNX"]},{"source":"CNA","vendor":"Tridium","product":"Niagara Framework","version":"affected 4.15.5 custom","platforms":["Windows","Linux","QNX"]},{"source":"CNA","vendor":"Tridium","product":"Niagara Enterprise Security","version":"affected 4.14.6 custom","platforms":["Windows","Linux","QNX"]},{"source":"CNA","vendor":"Tridium","product":"Niagara Enterprise Security","version":"affected 4.15.5 custom","platforms":["Windows","Linux","QNX"]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Tridium recommends upgrading to one of the following versions:\n  *  Niagara Framework 4.14u6\n  *  Niagara Enterprise Security 4.14u6\n  *  Niagara Framework 4.15u5\n  *  Niagara Enterprise Security 4.15u5\n\n\nor applying the following patched modules\n\n  *  program-rt.jar version 4.14.5.22.1\n  *  program-rt.jar version 4.15.4.24.1","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Umut Pirkoca","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-11804","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-23T18:15:31.790870Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-23T18:16:05.366Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Windows","Linux","QNX"],"product":"Niagara Framework","vendor":"Tridium","versions":[{"lessThan":"4.14.6","status":"affected","version":"0","versionType":"custom"},{"lessThan":"4.15.5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Windows","Linux","QNX"],"product":"Niagara Enterprise Security","vendor":"Tridium","versions":[{"lessThan":"4.14.6","status":"affected","version":"0","versionType":"custom"},{"lessThan":"4.15.5","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"reporter","value":"Umut Pirkoca"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.<p>This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.</p>"}],"value":"Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5."}],"impacts":[{"capecId":"CAPEC-122","descriptions":[{"lang":"en","value":"CAPEC-122 Privilege Abuse"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-280","description":"CWE-280 Improper handling of insufficient permissions or privileges","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-23T15:07:42.043Z","orgId":"0dc86260-d7e3-4e81-ba06-3508e030ce8d","shortName":"Honeywell"},"references":[{"url":"https://www.honeywell.com/us/en/product-security"},{"url":"https://www.tridium.com/us/en/product-security"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Tridium recommends upgrading to one of the following versions:<br><ul><li>Niagara Framework 4.14u6</li><li>Niagara Enterprise Security 4.14u6</li><li>Niagara Framework 4.15u5</li><li>Niagara Enterprise Security 4.15u5</li></ul><div>or applying the following patched modules</div><div><ul><li>program-rt.jar version 4.14.5.22.1</li><li>program-rt.jar version 4.15.4.24.1</li></ul></div>"}],"value":"Tridium recommends upgrading to one of the following versions:\n  *  Niagara Framework 4.14u6\n  *  Niagara Enterprise Security 4.14u6\n  *  Niagara Framework 4.15u5\n  *  Niagara Enterprise Security 4.15u5\n\n\nor applying the following patched modules\n\n  *  program-rt.jar version 4.14.5.22.1\n  *  program-rt.jar version 4.15.4.24.1"}],"source":{"discovery":"UNKNOWN"},"title":"Program Module Vulnerability","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"0dc86260-d7e3-4e81-ba06-3508e030ce8d","assignerShortName":"Honeywell","cveId":"CVE-2026-11804","datePublished":"2026-07-23T15:07:42.043Z","dateReserved":"2026-06-09T15:04:29.906Z","dateUpdated":"2026-07-23T18:16:05.366Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-23 16:17:13","lastModifiedDate":"2026-07-23 19:16:51","problem_types":["CWE-280","CWE-280 CWE-280 Improper handling of insufficient permissions or privileges"],"metrics":{"cvssMetricV31":[{"source":"psirt@honeywell.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-23T18:15:31.790870Z","id":"CVE-2026-11804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"11804","Ordinal":"1","Title":"Program Module Vulnerability","CVE":"CVE-2026-11804","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"11804","Ordinal":"1","NoteData":"Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.","Type":"Description","Title":"Program Module Vulnerability"}]}}}