CVE-2026-109812

CVE-2026-109812 is a missing-authorization flaw (CWE-862) in the internal /api/v1/secrets/ API on some Moxa industrial computing products. A low-privileged user who is already authenticated and can reach the device from an adjacent network can call that API without the required authorization checks. Successful use discloses confidential data, including cryptographic key material; the CVSS 4.0 score is 6.9 (medium), with high confidentiality impact and no integrity or availability impact. Only an unspecified subset of Moxa industrial computing products is described as affected, and no model or version ranges are given in the source data. It is not on CISA's KEV list, and no public proof-of-concept is known.

What to do: Apply the fixes in Moxa advisory AV26-1055 for every affected industrial computing model as soon as they are published, and confirm the /api/v1/secrets/ endpoint is no longer reachable by low-privilege accounts. Until patched, keep device management on an isolated adjacent network, remove unused low-privilege accounts, and treat any stored cryptographic material as potentially exposed if those accounts were used.