CVE-2026-57469: Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-08-28
Weakness: CWE-352

Description

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.

Affected products

KUNBUS PiCtory: through 2.16.0

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-57469

Get alerted when CVE-2026-57469 or the next vulnerability affects your stack