PT-2026-52989 · Undefined · Undefined

Published 2026-06-26 · Updated 2026-06-26 · CVE-2026-33560

NVD

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-33560

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33560 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-176-04 · Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json · Note