{"id":"CVE-2026-11804","state":"PUBLISHED","title":"Program Module Vulnerability","description":"Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.","publishedAt":"2026-07-23T15:07:42.043Z","updatedAt":"2026-07-23T18:16:05.366Z","severity":{"score":5.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","source":"Honeywell"},"assigner":"Honeywell","products":["Tridium Niagara Framework","Tridium Niagara Enterprise Security"],"affected":[{"vendor":"Tridium","product":"Niagara Framework","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.14.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"4.15.5","versionType":"custom"}],"platforms":["Windows","Linux","QNX"]},{"vendor":"Tridium","product":"Niagara Enterprise Security","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.14.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"4.15.5","versionType":"custom"}],"platforms":["Windows","Linux","QNX"]}],"references":["https://www.honeywell.com/us/en/product-security","https://www.tridium.com/us/en/product-security"],"weaknesses":["CWE-280"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/11xxx/CVE-2026-11804.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-11804","state":"PUBLISHED","datePublished":"2026-07-23T15:07:42.043Z","dateUpdated":"2026-07-23T18:16:05.366Z","assignerShortName":"Honeywell","assignerOrgId":"0dc86260-d7e3-4e81-ba06-3508e030ce8d","dateReserved":"2026-06-09T15:04:29.906Z"},"containers":{"cna":{"title":"Program Module Vulnerability","descriptions":[{"lang":"en","value":"Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.\n\nThis issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5."}],"affected":[{"vendor":"Tridium","product":"Niagara Framework","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.14.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"4.15.5","versionType":"custom"}],"platforms":["Windows","Linux","QNX"]},{"vendor":"Tridium","product":"Niagara Enterprise Security","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.14.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"4.15.5","versionType":"custom"}],"platforms":["Windows","Linux","QNX"]}],"references":[{"url":"https://www.honeywell.com/us/en/product-security"},{"url":"https://www.tridium.com/us/en/product-security"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.2,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-280","lang":"en","description":"CWE-280 Improper handling of insufficient permissions or privileges","type":"CWE"}]}],"providerMetadata":{"shortName":"Honeywell","orgId":"0dc86260-d7e3-4e81-ba06-3508e030ce8d","dateUpdated":"2026-07-23T15:07:42.043Z"},"impacts":[{"capecId":"CAPEC-122","descriptions":[{"lang":"en","value":"CAPEC-122 Privilege Abuse"}]}],"solutions":[{"lang":"en","value":"Tridium recommends upgrading to one of the following versions:\n  *  Niagara Framework 4.14u6\n  *  Niagara Enterprise Security 4.14u6\n  *  Niagara Framework 4.15u5\n  *  Niagara Enterprise Security 4.15u5\n\n\nor applying the following patched modules\n\n  *  program-rt.jar version 4.14.5.22.1\n  *  program-rt.jar version 4.15.4.24.1","supportingMedia":[{"type":"text/html","base64":false,"value":"Tridium recommends upgrading to one of the following versions:<br><ul><li>Niagara Framework 4.14u6</li><li>Niagara Enterprise Security 4.14u6</li><li>Niagara Framework 4.15u5</li><li>Niagara Enterprise Security 4.15u5</li></ul><div>or applying the following patched modules</div><div><ul><li>program-rt.jar version 4.14.5.22.1</li><li>program-rt.jar version 4.15.4.24.1</li></ul></div>"}]}],"credits":[{"lang":"en","value":"Umut Pirkoca","type":"reporter"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-23T18:15:31.790870Z","id":"CVE-2026-11804","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-23T18:16:05.366Z"}}]}}}