CVE-2026-22096

Missing authentication for webserver endpoints

CVSS 9.3 CRITICALCWE-306

Vexday Risk Score

25Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.3EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

EVbee · DC-80

References

https://csirt.divd.nl/DIVD-2026-00001/