PT-2026-44762 · Network Optix · Nxwitness Vms

Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-10056

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nx Witness VMS versions prior to 6.1.2

Description A CORS misconfiguration in the REST API occurs when the software runs in the default Standard security mode on Linux and Windows. This allows an unauthenticated remote attacker to steal the session token of an authenticated user and perform an Administrator Account Takeover by inducing the victim to visit a malicious cross-origin web page. Cross-Origin Resource Sharing (CORS) is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.

Recommendations Update to version 6.1.2 or later. As a temporary workaround for installations in Standard security mode, set Access-Control-Allow-Credentials to false by sending a PATCH request to the endpoint "/rest/v2/system/settings" with the body {"supportedOrigins": "null"}. Select High security level during initial setup.

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2026-10056

Affected Products

Nxwitness Vms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-10056 · Security Note
• https://support.networkoptix.com/hc/en-us/articles/39254208939159-How-to-Enable-CORS-Validation · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2060322907381723365 · Twitter Post