CVE-2026-65310: Missing authentication and permissive CORS policy

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-31 · updated 2026-08-28
Weakness: CWE-306

Description

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

Affected products

ANDRITZ 250 SCALA: through 7.20
ANDRITZ HIPASE-250: through 7.20

References

https://www.andritz.com/

Get alerted when CVE-2026-65310 or the next vulnerability affects your stack