Read the docs
TI-2026-10189 Aliases CVE-2026-11804GHSA-769r-j4hr-6567

Program Module Vulnerability

Priority LOW 23CWE-280Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed Niagara Framework (Tridium): 4.14.6, 4.15.5Niagara Enterprise Security (Tridium): 4.14.6, 4.15.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TridiumNiagara Frameworkbefore 4.14.6; before 4.15.54.14.6, 4.15.5Patch availableCNA
TridiumNiagara Enterprise Securitybefore 4.14.6; before 4.15.54.14.6, 4.15.5Patch availableCNA
  • Niagara Framework VendorTridium Affected before 4.14.6; before 4.15.5 Fixed in 4.14.6, 4.15.5 Patch available CNA
  • Niagara Enterprise Security VendorTridium Affected before 4.14.6; before 4.15.5 Fixed in 4.14.6, 4.15.5 Patch available CNA

Remediation

  • Fix · CNA Niagara Framework (Tridium) Fixed in 4.14.6, 4.15.5
  • Fix · CNA Niagara Enterprise Security (Tridium) Fixed in 4.14.6, 4.15.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11804
  2. 2026-10-03 Alias added: GHSA-769r-j4hr-6567

References

Other 2

  • TI-2017-12310 Improper authentication in ICS-CERT Niagara AX Framework and Niagara 4 Framework CVSS 3.0CRITICAL 9.8
  • TI-2012-04007 Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote… CVSS 2.0HIGH 9.3
  • TI-2025-03484 Improper Use of Validation Framework CVSS 3.1CRITICAL 9.8
  • TI-2025-03487 Use of GET Request Method With sensitive Query Strings CVSS 3.1HIGH 7.5
  • TI-2025-03489 Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) CVSS 3.1CRITICAL 9.8
  • TI-2025-03488 Incorrect permission assignment in Tridium Niagara Framework CVSS 3.1CRITICAL 9.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences