CODRA Panorama Suite up to 2510-04-10 file access

Summaryinfo

A vulnerability was found in CODRA Panorama Suite. It has been classified as problematic. This affects an unknown part. This manipulation causes file access. This vulnerability appears as CVE-2026-4760. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in CODRA Panorama Suite. It has been declared as problematic. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a file access vulnerability. The CWE definition for the vulnerability is CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be. As an impact it is known to affect confidentiality. The summary by CVE is:

From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if these files are accessible to the Servin process execution account. * Installations based on Panorama Suite 2022-SP1 (22.50.005) are vulnerable unless update PS-2210-02-4079 (or higher) is installed * Installations based on Panorama Suite 2023 (23.00.004) are vulnerable unless updates PS-2300-03-3078 (or higher) and PS-2300-04-3078 (or higher) and PS-2300-82-3078 (or higher) are installed * Installations based on Panorama Suite 2025 (25.00.016) are vulnerable unless updates PS-2500-02-1078 (or higher) and PS-2500-04-1078 (or higher) are installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are vulnerable unless updates PS-2510-02-1077 (or higher) and PS-2510-04-1077 (or higher) are installed Please refer to security bulletin BS-035, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt .

The advisory is shared at my.codra.net. This vulnerability is known as CVE-2026-4760 since 03/24/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1083 for this issue.

Upgrading to version PS-2210-02-4079 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• CODRA

Name

• Panorama Suite

Version

• 22.50.005
• 23.00.004
• 25.00.016
• 25.10.007
• 2210-02-40
• 2300-03-30
• 2300-04-30
• 2300-82-30
• 2500-02-10
• 2500-04-10
• 2510-02-10
• 2510-04-10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion