CVE-2026-27546Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-288

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-09-16); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-16	1	Patch1
2026-09-17	1	Disclosure1
2026-09-29	1	Disclosure1

Full discourse3 posts

DFIR Radar@DFIR_Radar33d
Disclosure
Nozomi found 19 flaws in Pepperl+Fuchs IO-Link Master firmware 1.7.3, including CVE-2026-27546 auth bypass yielding root in two HTTPS requests. Monitor WebUI logs for non-standard usernames and path traversal patterns in /api/ requests. #DFIR_Radar https://t.co/CefC55jy2G
Post summary
The tweet discloses CVE‑2026‑27546 as an authentication bypass in Pepperl+Fuchs IO‑Link Master firmware 1.7.3 that grants root after two HTTPS requests and advises monitoring WebUI logs for suspicious activity.
10000173
2.0K followersView on X
Cybersecurity News DE@cybsecuritynews45d
Disclosure
#schwachstellen CVE-2026-27546: Kritischer Authentifizierungs-Bypass ermöglicht Admin-Login ohne Zugangsdaten #adminlogin #authentifizierungsbypass #cve202627546 #nvd https://cybersecurity-news.de/cve-2026-27546-authentifizierungs-bypass-admin-login-ohne-zugangsdaten
Post summary
The post discloses CVE-2026-27546, highlighting a critical authentication bypass vulnerability that permits administrative login without credentials, and directs readers to a news article for further information.
0000028
12 followersView on X
ThreatAft@ThreatAft46d
Patch
🚨 IODD/IO-LINK — CVSS 9.8 ×2 CVE-2026-27546: Auth bypass → unauthenticated admin login CVE-2026-27565: Root RCE via malicious IODD file → survives reboots Fixed: Firmware 1.7.4 PATCH NOW. → https://threataft.com/articles/iodd-iolink-cve-2026-27546-cve-2026-27565-industrial-rce #IODD #IOLink #CVE #RCE #OTSecurity #PatchNow
Post summary
The tweet discloses two critical IODD/IO‑LINK CVEs (auth bypass and RCE) with technical details and a CVSS 9.8 score, and states that firmware version 1.7.4 addresses the issues, urging immediate patching.
0000038
43 followersView on X

Explore more

Back to dashboard