CVE-2026-1670CRITICAL 9.8EPSS p52.8%

CVE-2026-1670CVE-2026-1670

Description

The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.83% probability of exploitation · percentile 52.8% · 2026-06-19T12:03:05Z
Published2026-02-17
Last modified2026-04-15

Underlying weaknesses· 1

CWE-306

References

  1. https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-048-04.json
  2. https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-04
  3. https://www.honeywell.com/us/en/contact/support

1

TypeTargetConfidenceTier
WeaknessMissing Authentication for Critical Functioncwe-3060%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-24789
CVE
CVE-2026-8046
CVE
CVE-2026-48902
CVE
CVE-2025-13607
CVE
CVE-2026-25197
CVE
CVE-2025-40805
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.