CVE-2026-90451

CVE-2026-90451 is a use-of-default-secret flaw (CWE-1392): an example environment-configuration file shipped with the product contains a fixed, publicly known value used to sign authentication cookies for a bundled packet-analysis component. The flaw is triggered when a deployment copies this example file into its active configuration without running the setup routine that is supposed to regenerate the value. An attacker who knows the default can forge valid authentication cookies and gain unauthenticated access to the component's authenticated functionality, with CVSS 4.0 scoring network exploitability, no privileges or user interaction required, and High impact to integrity. Only deployments that used the example file as-is and skipped the secret-regeneration step are affected; installations that completed setup with a unique generated secret are not. There is no evidence of exploitation so far: no public proof-of-concept, no listing in CISA's KEV, and the assignment by CISA ICS-CERT indicates an industrial/OT product context.

What to do: Audit the packet-analysis component's active environment configuration to determine whether it was taken from the bundled example file; if so, run the vendor's setup routine to regenerate the cookie-signing secret, or manually replace the default with a strong, unique random value and restart the component to invalidate any cookies signed with the old secret. Until remediated, restrict network access to the component. Contact the vendor for guidance and updated releases that prevent the default secret from being used in active configurations.