CVE-2026-2403
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerability allows a Web Admin user to alter the POST /logsettings request payload and cause Event and Data Log truncation, impacting log integrity.
Risk Assessment
Loss or truncation of logs can hinder incident detection and audit trails, weakening the organization's ability to respond to threats.
Recommendation
Apply the vendor's available fixes and restrict Web Admin privileges to the minimum necessary. Monitor log integrity.
Other vulnerabilities in Web Admin
See all- CVE-2026-2405Medium
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
- CVE-2026-2401Medium
CWE-532 insertion of sensitive information into a log file can expose confidential data when a Web Admin user executes a malicious file provided by an attacker.
- CVE-2025-11565High
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
Original NVD description (English source)
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS