Read the docs
TI-2021-08404 Aliases CVE-2021-26726GHSA-f4vp-f6h9-8cx8

Remote code execution in Valmet DNA before Collection 2021

Priority MEDIUM 40CWE-209Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-209 and CWE-78.

Summary

A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.

Why it matters now

EPSS 0.01148 67th percentileScored 2026-11-07
Fix Fixed Valmet DNA (Valmet DNA): Collection 2021

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Valmet DNAValmet DNACollection 2012 to before Collection 2021Collection 2021Patch availableCNA
  • Valmet DNA VendorValmet DNA Affected Collection 2012 to before Collection 2021 Fixed in Collection 2021 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:valmet:dna:*:*:*:*:*:*:*:*2012 – 2021VulnerableValmet
  • cpe:2.3:a:valmet:dna:*:*:*:*:*:*:*:* Versions 2012 – 2021 Vulnerable ·Valmet

Remediation

  • Fix · CNA Valmet DNA (Valmet DNA) Fixed in Collection 2021

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-26726
  2. 2026-10-03 Alias added: GHSA-f4vp-f6h9-8cx8

References

Advisory 2

  • TI-2025-14216 Valmet DNA Web server arbitrary file read access CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences