PT-2025-46539 · Altair · Altair Grid Engine

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-40760

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Altair Grid Engine versions prior to 2026.0.0

Description The software does not properly handle error messages, leading to the disclosure of sensitive password hash information during user authentication requests. This could allow a local attacker to extract password hashes for privileged accounts, potentially enabling offline brute-force attacks. The API endpoint involved in this issue is the user authentication request process. The vulnerable information is the password hash.

Recommendations Update to version 2026.0.0 or later.

Fix

Generation of Error Message Containing Sensitive Information

Uncontrolled Search Path Element

Weakness Enumeration

CWE-209

CWE-427

Related Identifiers

BDU:2026-05804

BDU:2026-05805

CVE-2025-40760

Affected Products

Altair Grid Engine

References · 9

• https://bdu.fstec.ru/vul/2026-05804 · Security Note
• https://bdu.fstec.ru/vul/2026-05805 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-40760 · Security Note
• https://windowsforum.com/threads/siemens-altair-grid-engine-local-vulnerabilities-patch-cve-2025-40760-and-cve-2025-40763.389277 · Note
• https://t.me/CVEtracker/37084 · Telegram Post
• https://vuldb.com/ru/?id.332069 · Note
• https://cvefeed.io/vuln/detail/CVE-2025-40760 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-514895.html · Note
• https://twitter.com/CVEnew/status/1988348964693741735 · Twitter Post