CVE-2026-34009
HighCVSS 8.4Summary
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
Risk Assessment
Improper isolation may allow a local attacker with administrator privileges to compromise the security of the system.
Recommendation
Update Notes Station 3 to version 3.9.11 or later to address the vulnerability.
Other vulnerabilities in Notes Station 3
See all- CVE-2026-39991Medium
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. The vulnerability has been fixed in version 3.9.12 and later.
- CVE-2026-34008High
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
- CVE-2026-34007Medium
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in version 3.9.11 and later.
Original NVD description (English source)
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS