{"id":"CVE-2026-118465","kind":"vulnerability","aliases":["CVE-2026-118465"],"related":[],"title":"Shared components ship hard-coded database credentials identical across every installation","description":"Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.","summary":"Shared components include hard-coded Access, workgroup, CCBasic, DBISAM and related database credentials that are the same in every installation. An attacker who learns these built-in credentials could access the underlying databases.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["access","database","dbisam","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:23+00:00","updated_at":"2026-11-09T12:27:23+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-09T12:27:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Shared components ship hard-coded database credentials identical across every installation","impact":"medium","summary":"Shared components include hard-coded Access, workgroup, CCBasic, DBISAM and related database credentials that are the same in every installation. An attacker who learns these built-in credentials could access the underlying databases.","audience":"businesses","category":"other","nicknames":[],"who_cares":["database","access","dbisam"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or modifies database contents using built-in credentials","analyst_note":"Identify the vendor and product shipping these shared components and check the NVD entry for affected versions and fixes.","how_to_check":"unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":4501,"output_tokens":364,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118465':15A,18A '-2026':14A,17A 'access':19B,28B,53B,63C 'across':10A,74C 'attack':44B 'built':49B 'built-in':48B 'ccbasic':30B,65C 'code':6A,27B,62C 'compon':2A,23B,58C 'could':52B 'credenti':8A,35B,51B,70C 'cve':13A,16A 'databas':7A,20B,34B,56B,69C 'dbisam':21B,31B,66C 'everi':11A,41B 'expos':59C 'hard':5A,26B,61C 'hard-cod':4A,25B,60C 'ident':9A,73C 'includ':24B 'instal':12A,42B,75C 'learn':46B 'relat':33B,68C 'share':1A,22B,57C 'ship':3A 'under':55B 'workgroup':29B,64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["access","database","dbisam","medium","other"],"campaign_type":null,"search_a":"'-118465':15A,18A '-2026':14A,17A 'across':10A 'code':6A 'compon':2A 'credenti':8A 'cve':13A,16A 'databas':7A 'everi':11A 'hard':5A 'hard-cod':4A 'ident':9A 'instal':12A 'share':1A 'ship':3A","search_b":"'access':19B,28B,53B 'attack':44B 'built':49B 'built-in':48B 'ccbasic':30B 'code':27B 'compon':23B 'could':52B 'credenti':35B,51B 'databas':20B,34B,56B 'dbisam':21B,31B 'everi':41B 'hard':26B 'hard-cod':25B 'includ':24B 'instal':42B 'learn':46B 'relat':33B 'share':22B 'under':55B 'workgroup':29B","search_c":"'access':63C 'across':74C 'ccbasic':65C 'code':62C 'compon':58C 'credenti':70C 'databas':69C 'dbisam':66C 'expos':59C 'hard':61C 'hard-cod':60C 'ident':73C 'instal':75C 'relat':68C 'share':57C 'workgroup':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118465","severity":null,"published_at":"2026-11-09T12:16:37+00:00","modified_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}