Vulnerability record

CVE-2026-63248

ElevatedNo known exploitation

Patch status

Official fix available since Oct 15, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Description

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateOct 15, 2026
CVE-2026-63248 scored CVSS 6.9
Basis: NIST National Vulnerability Database
Patch releasedUpdateOct 15, 2026
Patch released for CVE-2026-63248
An official fix is now available.
Basis: NVD patch reference

Coverage

CriticalReview

Eclipse Foundation Eclipse Milo

CISA Cybersecurity Advisories7 hours agoCritical infra

References

github.com https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a
gitlab.eclipse.org https://gitlab.eclipse.org/security/cve-assignment/-/work_items/181
gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598