PT-2026-67699

CVE-2026-63248

Published

2026-08-04

Updated

2026-08-05

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 0.6.0 through 1.1.4

Description OPC UA server diagnostics nodes fail to enforce access authorization. This allows an anonymous client to enable diagnostics via a None/None endpoint without a certificate. Additionally, a client using a trusted application certificate over SignAndEncrypt can read security diagnostics for other active sessions, which exposes usernames, login history, authentication mechanisms, security modes, policies, and public client certificates.

Recommendations Update Eclipse Milo to a version later than 1.1.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Abhinav Agarwal

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers