CVE-2026-18931

Talassoft Industrial Management Software contains hard-coded credentials (CWE-798), meaning fixed, embedded credentials are shipped with the product and can be used to authenticate. Because the issue is network-exploitable with no privileges or user interaction required (CVSS 9.1), a remote attacker who can reach a vulnerable instance can use these embedded credentials to authenticate and retrieve sensitive data accessible through the product. The CVSS vector also indicates a high integrity impact, suggesting an attacker who authenticates with the hard-coded credentials may be able to modify data as well. Any organization running Talassoft Industrial Management Software from V.4 up to, but not including, V.16 is affected. There are currently no known reports of exploitation in the wild, no public proof-of-concept, and a low 0.2% EPSS probability of exploitation within 30 days.

What to do: Upgrade Talassoft Industrial Management Software to V.16 or later, which resolves this issue. Until upgraded, restrict network access to the application (no direct internet exposure; VPN or firewall rules only), and review deployments for use of the vendor's embedded hard-coded credentials, replacing them with unique credentials where the product allows. Monitor vendor and USOM advisories for updated guidance.