CVE-2026-4761

Estado: En análisisBaja (3.3)—

Please refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt.

Detalles técnicos trazas, registros y código del informe original

When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group.
  *  Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed
  *  Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Puntuación base: 3.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.19%
Percentil entre todas las CVEs puntuadas: 8
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Codra — Panorama Collaborative Operation & Execution Codra — Panorama COM Codra — Panorama E2 Codra — Panorama H2

CWE

CWE-732

Referencias

https://my.codra.net/api/csirt/download?resourceId=1469&fileType=FichierPDF

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-4761",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4761",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-25T13:06:35.347666Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "30aa36b7-a224-4bc9-b7d3-abea20aa4887",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 3.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
          "exploitMaturity": "UNREPORTED",
          "providerUrgency": "AMBER",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "30aa36b7-a224-4bc9-b7d3-abea20aa4887",
      "affectedData": [
        {
          "vendor": "CODRA",
          "modules": [
            "Network and Security Tool"
          ],
          "product": "Panorama Suite",
          "versions": [
            {
              "status": "affected",
              "version": "Panorama Suite 2025",
              "lessThan": "update PS-2500-00-0357",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "Panorama Suite 2025 Updated Dec. 25"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-25T13:16:28.310",
  "references": [
    {
      "url": "https://my.codra.net/api/csirt/download?resourceId=1469&fileType=FichierPDF",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "30aa36b7-a224-4bc9-b7d3-abea20aa4887"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "30aa36b7-a224-4bc9-b7d3-abea20aa4887",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group.\n  *  Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed\n  *  Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable\n\n\nPlease refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt."
    },
    {
      "lang": "es",
      "value": "Cuando se instala un certificado y su clave privada en el almacén de certificados de la máquina Windows utilizando la herramienta de Red y Seguridad, se conceden innecesariamente derechos de acceso a la clave privada al grupo de operadores.\n\n*   Las instalaciones basadas en Panorama Suite 2025 (25.00.004) son vulnerables a menos que se instale la actualización PS-2500-00-0357 (o superior).\n*   Las instalaciones basadas en Panorama Suite 2025 Actualizado 25 Dic. (25.10.007) no son vulnerables.\n\nConsulte el boletín de seguridad BS-036, disponible en el sitio web del CSIRT de Panorama: https://my.codra.net/en-gb/csirt."
    }
  ],
  "lastModified": "2026-06-17T10:57:11.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:codra:panorama_collaborative_operation_\\&_execution:25.00.004:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2E17453-9392-40F1-94B9-B43725C91AE6"
            },
            {
              "criteria": "cpe:2.3:a:codra:panorama_com:25.00.004:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E7ADB78-2574-4CE8-A39C-A67F6DCE4EED"
            },
            {
              "criteria": "cpe:2.3:a:codra:panorama_e2:25.00.004:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B992EF9-A765-45DB-AD47-16300D7F3B80"
            },
            {
              "criteria": "cpe:2.3:a:codra:panorama_h2:25.00.004:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B268371-5F90-40DB-9D6D-BCCB781CDC08"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "30aa36b7-a224-4bc9-b7d3-abea20aa4887"
}