CVE-2026-11804 - Vulnerability Details - OpenCVE

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.honeywell.com/us/en/product-security
https://www.tridium.com/us/en/product-security

History

Thu, 23 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.
Title		Program Module Vulnerability
Weaknesses		CWE-280
References		https://www.honeywell.com/us/en/product-security https://www.tridium.com/us/en/product-security
Metrics		cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Honeywell

Published: 2026-07-23T15:07:42.043Z

Updated: 2026-07-23T18:16:05.366Z

Reserved: 2026-06-09T15:04:29.906Z

Link: CVE-2026-11804

Vulnrichment

Updated: 2026-07-23T18:16:00.703Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11804", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "state": "PUBLISHED", "assignerShortName": "Honeywell", "dateReserved": "2026-06-09T15:04:29.906Z", "datePublished": "2026-07-23T15:07:42.043Z", "dateUpdated": "2026-07-23T18:16:05.366Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2026-07-23T15:07:42.043Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-280", "description": "CWE-280 Improper handling of insufficient permissions or privileges", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Tridium", "product": "Niagara Framework", "platforms": ["Windows", "Linux", "QNX"], "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Tridium", "product": "Niagara Enterprise Security", "platforms": ["Windows", "Linux", "QNX"], "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.<p>This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.</p>"}]}], "references": [{"url": "https://www.honeywell.com/us/en/product-security"}, {"url": "https://www.tridium.com/us/en/product-security"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Tridium recommends upgrading to one of the following versions:\n * Niagara Framework 4.14u6\n * Niagara Enterprise Security 4.14u6\n * Niagara Framework 4.15u5\n * Niagara Enterprise Security 4.15u5\n\n\nor applying the following patched modules\n\n * program-rt.jar version 4.14.5.22.1\n * program-rt.jar version 4.15.4.24.1", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Tridium recommends upgrading to one of the following versions:<br><ul><li>Niagara Framework 4.14u6</li><li>Niagara Enterprise Security 4.14u6</li><li>Niagara Framework 4.15u5</li><li>Niagara Enterprise Security 4.15u5</li></ul><div>or applying the following patched modules</div><div><ul><li>program-rt.jar version 4.14.5.22.1</li><li>program-rt.jar version 4.15.4.24.1</li></ul></div>"}]}], "credits": [{"lang": "en", "value": "Umut Pirkoca", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}, "title": "Program Module Vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T18:15:31.790870Z", "id": "CVE-2026-11804", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T18:16:05.366Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11804", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T18:15:31.790870Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T18:16:00.703Z"}}], "cna": {"title": "Program Module Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Umut Pirkoca"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tridium", "product": "Niagara Framework", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "unaffected"}, {"vendor": "Tridium", "product": "Niagara Enterprise Security", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.5", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Tridium recommends upgrading to one of the following versions:\n * Niagara Framework 4.14u6\n * Niagara Enterprise Security 4.14u6\n * Niagara Framework 4.15u5\n * Niagara Enterprise Security 4.15u5\n\n\nor applying the following patched modules\n\n * program-rt.jar version 4.14.5.22.1\n * program-rt.jar version 4.15.4.24.1", "supportingMedia": [{"type": "text/html", "value": "Tridium recommends upgrading to one of the following versions:<br><ul><li>Niagara Framework 4.14u6</li><li>Niagara Enterprise Security 4.14u6</li><li>Niagara Framework 4.15u5</li><li>Niagara Enterprise Security 4.15u5</li></ul><div>or applying the following patched modules</div><div><ul><li>program-rt.jar version 4.14.5.22.1</li><li>program-rt.jar version 4.15.4.24.1</li></ul></div>", "base64": false}]}], "references": [{"url": "https://www.honeywell.com/us/en/product-security"}, {"url": "https://www.tridium.com/us/en/product-security"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.", "supportingMedia": [{"type": "text/html", "value": "Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.<p>This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE-280 Improper handling of insufficient permissions or privileges"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2026-07-23T15:07:42.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11804", "state": "PUBLISHED", "dateUpdated": "2026-07-23T18:16:05.366Z", "dateReserved": "2026-06-09T15:04:29.906Z", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "datePublished": "2026-07-23T15:07:42.043Z", "assignerShortName": "Honeywell"}, "dataVersion": "5.2"}