CVE-2026-81855

Wärtsilä FOS-Onboard, a shipboard fleet operations software suite, contains a hardcoded cryptographic client authentication key (CWE-321) in its robot testing framework component. Because the key is embedded in shipped software, anyone who obtains a copy of the product can extract it and impersonate a legitimate client to the authentication mechanism, with no privileges or user interaction required (CVSS 4.0: 9.3, network vector, high confidentiality and integrity impact). A successful attacker could gain unauthorized read and write access to onboard system data, though the advisory indicates no direct availability impact. Affected parties are vessel operators and offshore assets running FOS-Onboard, particularly any deployments where the testing framework component is present and reachable on the ship's network. No public proof-of-concept exists and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not known to be occurring.

What to do: Contact Wärtsilä to confirm which FOS-Onboard builds are affected and apply the vendor's patched release when available. In the meantime, disable or remove the robot testing framework component from production onboard systems, and use network segmentation/firewall rules to restrict which hosts can reach the affected authentication service. Rotate any related keys or credentials and review authentication logs for anomalous client connections.