CVE-2026-94459 · Infrastructure
NO FIX YET
IRISPowerscan ships with default user accounts that use predictable credentials. An attacker with network access to an installation can log in with them and read or change application data and configuration.
first public Nov 4, 2026 · 2 sources
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
IRISPowerscan (I.R.I.S. SA, document capture software) installations that keep default user accounts with predictable credentials are exposed to someone on the adjacent network. Versions affected are not stated by any source found. Installations where default accounts were removed or given unique strong passwords can skip it, as can hosts not reachable by untrusted users.
Not affected if default-credentials-changed
Who cares default-credentials, irispowerscan
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-94459") · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.