{"id":"CVE-2026-94459","kind":"vulnerability","aliases":["CVE-2026-94459"],"related":[],"title":"IRISPowerscan: default accounts with predictable credentials allow unauthorised access","description":"IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration.","summary":"IRISPowerscan ships with default user accounts that use predictable credentials. An attacker with network access to an installation can log in with them and read or change application data and configuration.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["default-credentials","infrastructure","irispowerscan"],"not_affected_if":["default-credentials-changed"],"how_to_check":"- Versions, default account names and fix are not published in any source found. Review the user list in IRISPowerscan (users and groups) for factory-created accounts and confirm each has a unique, non-default password; also check the installation account (see CVE-2026-94460). CVSS vector is adjacent-network, so restrict access to the IRISPowerscan host to trusted segments.","fix":null,"status":"open","published_at":"2026-11-04T10:17:26+00:00","first_seen_at":"2026-11-04T10:26:35+00:00","triaged_at":"2026-11-04T10:27:11+00:00","updated_at":"2026-11-04T10:28:24+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-04T10:27:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IRISPowerscan: default accounts with predictable credentials allow unauthorised access","impact":"high","summary":"IRISPowerscan ships with default user accounts that use predictable credentials. An attacker with network access to an installation can log in with them and read or change application data and configuration.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["irispowerscan"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in and modifies application data and configuration","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-94459) for affected versions, default account names and vendor remediation.","how_to_check":"- Look for default or factory user accounts in the IRISPowerscan application and confirm whether their credentials were changed.\n- unknown for version ranges and exact setting names: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["default-credentials-changed"],"who_is_affected":"Installations of IRISPowerscan that still use the default user accounts are exposed, since an attacker can log in with predictable credentials. Installations where those accounts were removed or given strong unique passwords are not affected by this description. The sources do not name the affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4107,"output_tokens":498,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-94459) for affected versions, default account names and vendor remediation.","search":"'-2026':11A,14A '-94459':12A,15A 'access':9A,35B,64C,79C,90C 'account':3A,26B,56C,85C 'affect':67C,84C 'allow':7A 'applic':48B,77C,94C 'attack':32B,62C 'authent':74C 'avail':81C 'chang':47B 'configur':51B,97C 'contain':53C 'could':69C 'credenti':6A,18B,30B,59C,72C 'cve':10A,13A 'data':49B,95C 'default':2A,17B,24B,54C 'default-credenti':16B 'function':80C 'infrastructur':19B 'instal':38B,68C 'irispowerscan':1A,20B,21B,52C 'log':40B 'modif':92C 'network':34B 'potenti':86C 'predict':5A,29B,58C 'read':45B 'result':87C 'ship':22B 'unauthent':61C 'unauthoris':8A,89C 'use':28B,70C 'user':25B,55C","nicknames":[],"mitigations":[],"who_affected":"IRISPowerscan (I.R.I.S. SA, document capture software) installations that keep default user accounts with predictable credentials are exposed to someone on the adjacent network. Versions affected are not stated by any source found. Installations where default accounts were removed or given unique strong passwords can skip it, as can hosts not reachable by untrusted users.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["defaultcredentials","high","infrastructure","irispowerscan"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94459","severity":null,"published_at":"2026-11-04T10:17:26+00:00","modified_at":"2026-11-04T10:17:26+00:00","first_seen_at":"2026-11-04T10:26:35+00:00","fetched_at":"2026-11-04T10:26:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94459:1655","url":null,"severity":null,"published_at":"2026-11-04T10:28:24+00:00","modified_at":"2026-11-04T10:28:24+00:00","first_seen_at":"2026-11-04T10:28:24+00:00","fetched_at":"2026-11-04T10:28:24+00:00","note":"No vendor/I.R.I.S. advisory found; only NVD/Rapid7/Threatist rewrites, none list versions, account names or a fix. Sibling CVE-2026-94460 (installation account, elevated privileges, predictable password) looks related. Nothing verified. Vendor advisory needed to settle versions and fix."}],"documents":[{"id":66158,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-94459/","title":"Rapid7: CVE-2026-94459 IRISPowerscan default accounts","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}