CVE-2026-34008
HighCVSS 8.5Summary
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
Risk Assessment
Incorrect permissions on a critical resource may allow a local attacker with user privileges to compromise the security of the system.
Recommendation
Update Notes Station 3 to version 3.9.11 or later to fix the vulnerability.
Other vulnerabilities in Notes Station 3
See all- CVE-2026-39991Medium
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. The vulnerability has been fixed in version 3.9.12 and later.
- CVE-2026-34009High
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
- CVE-2026-34007Medium
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in version 3.9.11 and later.
Original NVD description (English source)
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS