---
id: "CVE-2026-94459"
kind: "vulnerability"
aliases: ["CVE-2026-94459"]
title: "IRISPowerscan: default accounts with predictable credentials allow unauthorised access"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["default-credentials", "infrastructure", "irispowerscan"]
not_affected_if: ["default-credentials-changed"]
published_at: "2026-11-04T10:17:26+00:00"
first_seen_at: "2026-11-04T10:26:35+00:00"
updated_at: "2026-11-04T10:28:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94459", "first_seen_at": "2026-11-04T10:26:35+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:28:24+00:00"}]
---

# IRISPowerscan: default accounts with predictable credentials allow unauthorised access

IRISPowerscan ships with default user accounts that use predictable credentials. An attacker with network access to an installation can log in with them and read or change application data and configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Versions, default account names and fix are not published in any source found. Review the user list in IRISPowerscan (users and groups) for factory-created accounts and confirm each has a unique, non-default password; also check the installation account (see CVE-2026-94460). CVSS vector is adjacent-network, so restrict access to the IRISPowerscan host to trusted segments.

## Timeline

- 2026-11-04T10:26:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94459
- 2026-11-04T10:28:24+00:00 analyst — No vendor/I.R.I.S. advisory found; only NVD/Rapid7/Threatist rewrites, none list versions, account names or a fix. Sibling CVE-2026-94460 (installation account, elevated privileges, predictable password) looks related. Nothing verified. Vendor advisory needed to settle versions and fix.

## Documents

- [describes] Rapid7: CVE-2026-94459 IRISPowerscan default accounts https://www.rapid7.com/db/vulnerabilities/cve-2026-94459/

## From the sources

IRISPowerscan contain
default user accounts with predictable credentials. An unauthenticated attacker
with access to an affected installation could use these credentials to
authenticate to the application and access functionality available to the
affected accounts, potentially resulting in unauthorised access or modification
of application data and configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_