PT-2026-21789 · Tattile · Vega+2

Gjoko Krstic · Published 2026-02-24 · Updated 2026-03-22 · CVE-2026-26341

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tattile Smart+, Vega, and Basic device families versions 1.181.5 and prior

Description The device families ship with default credentials that are not required to be changed during setup. An attacker reaching the management interface can use these default credentials to gain administrative access, potentially allowing unauthorized access to device configuration and data.

Recommendations Change the default credentials on all affected devices.

Exploit

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2026-26341

Affected Products

Basic

Tattile Smart+

Vega

References · 11

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.php · Exploit
• https://osv.dev/vulnerability/CVE-2026-26341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26341 · Security Note
• https://t.me/cveNotify/153345 · Telegram Post
• https://twitter.com/TheRabbitPy/status/2035619820616507506 · Twitter Post
• https://t.me/CVEtracker/45648 · Telegram Post
• https://tattile.com · Note
• https://vulncheck.com/advisories/tattile-smart-vega-basic-default-credentials · Note
• https://twitter.com/CVEnew/status/2026676438494228586 · Twitter Post
• https://twitter.com/TheHackerWire/status/2027104363664322674 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026486626436702441 · Twitter Post