What’s Vulnerable › Vulnerabilities

CVE-2026-4901: Insertion of Sesitive Information into Log File in AlanWeb SCADA

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-10-26
• Weakness: CWE-532

Description

AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5

Affected products

• Hydrosystem.Poznan Control System: before 9.8.5 — fixed in 9.8.5

How to fix

Upgrade to a fixed version: Hydrosystem.Poznan Control System 9.8.5. Check the vendor advisory for mitigations.

References

• https://cert.pl/posts/2026/04/CVE-2026-4901/
• https://control-system.pl/

Get alerted when CVE-2026-4901 or the next vulnerability affects your stack