{"id":"CVE-2026-13599","kind":"vulnerability","aliases":["CVE-2026-13599"],"related":[],"title":"ABB Ability Edgenius: missing authentication on a critical function","description":"Missing authentication for critical function vulnerability in ABB Ability Edgenius.\n\nThis issue affects Ability Edgenius: through 3.2.3.0.","summary":"ABB Ability Edgenius through 3.2.3.0 exposes a critical function without requiring authentication. An attacker who can reach the service may invoke that function without logging in.","severity":"high","cvss":7.8,"epss":0.00131,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abb-ability-edgenius","industrial-control","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the installed Edgenius version is `3.2.3.0` or earlier\n- Check whether the Edgenius service is reachable from untrusted networks\n- Details of the affected function are unknown from the sources","fix":"- Upgrade ABB Ability Edgenius to a version later than `3.2.3.0` once the vendor publishes it (fixed version unknown from the sources)\n- Restrict network access to the Edgenius service until patched","status":"open","published_at":"2026-10-22T18:17:28+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:08:11+00:00","updated_at":"2026-10-25T03:08:11+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T03:08:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ABB Ability Edgenius to a version later than `3.2.3.0` once the vendor publishes it (fixed version unknown from the sources)\n- Restrict network access to the Edgenius service until patched","reach":"unknown","title":"ABB Ability Edgenius: missing authentication on a critical function","impact":"high","summary":"ABB Ability Edgenius through 3.2.3.0 exposes a critical function without requiring authentication. An attacker who can reach the service may invoke that function without logging in.","category":"infrastructure","nicknames":[],"who_cares":["abb-ability-edgenius","industrial-control","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"unauthenticated attacker invokes a critical function on the service","analyst_note":"Check the ABB security advisory for the affected function, the fixed version and the network exposure conditions (source: https://nvd.nist.gov/vuln/detail/CVE-2026-13599).","how_to_check":"- Confirm the installed Edgenius version is `3.2.3.0` or earlier\n- Check whether the Edgenius service is reachable from untrusted networks\n- Details of the affected function are unknown from the sources","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running ABB Ability Edgenius version 3.2.3.0 or earlier. The sources do not describe the deployment conditions or which function is exposed, so the exposure depends on whether the service is reachable from outside the trusted network.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3299,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-13599':12A,15A '-2026':11A,14A '3.2.3.0':31B,68C 'abb':1A,17B,27B,59C 'abb-ability-edgenius':16B 'abil':2A,18B,28B,60C,65C 'affect':64C 'attack':40B 'authent':5A,38B,53C 'control':22B 'critic':8A,34B,55C 'cve':10A,13A 'edgenius':3A,19B,29B,61C,66C 'expos':32B 'function':9A,35B,49B,56C 'host':26B 'industri':21B 'industrial-control':20B 'infrastructur':23B 'invok':47B 'issu':63C 'log':51B 'may':46B 'miss':4A,52C 'reach':43B 'requir':37B 'self':25B 'self-host':24B 'servic':45B 'vulner':57C 'without':36B,50B","nicknames":[],"mitigations":[],"who_affected":"Organisations running ABB Ability Edgenius version 3.2.3.0 or earlier. The sources do not describe the deployment conditions or which function is exposed, so the exposure depends on whether the service is reachable from outside the trusted network.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T18:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:I/V:D/RE:L/U:Amber","cvss_by":"cybersecurity@ch.abb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13599","severity":null,"published_at":"2026-10-22T18:17:28+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-13599","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-13599","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}