CVE-2026-65309: Storage of passwords in a reversible format

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-31 · updated 2026-08-28
Weakness: CWE-257

Description

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.

Affected products

ANDRITZ 250 SCALA: through 7.20
ANDRITZ HIPASE-250: through 7.20

References

https://www.andritz.com/

Get alerted when CVE-2026-65309 or the next vulnerability affects your stack