Severity: HighAction: Review
Vulnerability record
CVE-2026-109812
Severity: ElevatedExploitation: No known exploitation
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.
Description
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdate
CVE-2026-109812 scored CVSS 6.9
Basis: NIST National Vulnerability Database
- Disclosed
Moxa AIG-302 ThingsPro Edge
Basis: CISA Cybersecurity Advisories (government advisory)