CVE-2026-94410

mediumpriority · track · 17OT risk · elevatedEPSS 0.002 · 14 %ileDE
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.24% (14th) EPSS
CVSS 4.3 · medium
Is it mine?
2 products
Check your exposure
Who says so?
1 sources
bender_psirt

EPSS · scored 2026-10-22

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No fix is available; mitigate or reduce exposure.

  • No fix availableCustomer&Partner 5.0.0<5.17.5bender_psirt

    Bender service updated to version 5.17.5 or later. The fix is planned in Q4 2026.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.3–5.3

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nprimary · info@cert.vde.comexploitability 2.8 · impact 1.4
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · Bender PSIRT DE
v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · info@cert.vde.com
v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-862USCWE-862US
05

affected products (2)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2026-109Bender Customer&Partner Platform Vulnerability - Privilege Escalation2026-10-13csaf · bender_psirtDE

    Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform. The issue allows any account to view the roles of other users. Bender has analyzed the weakness and determined that user information and user credentials are not affected. Bender considers the weakness to be of medium risk which should be patched.

07

sources

Which sources assert this record, and when.

bender_psirtNVDCVE.orgMITRE
published 2026-10-13modified 2026-10-16
08

references (1) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan