---
id: "CVE-2026-94460"
kind: "vulnerability"
aliases: ["CVE-2026-94460"]
title: "IRISPowerscan: default installation account has elevated privileges and a predictable password"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["default-credentials", "industrial-software", "infrastructure", "irispowerscan", "windows"]
not_affected_if: ["default-credentials-changed"]
published_at: "2026-11-04T10:17:26+00:00"
first_seen_at: "2026-11-04T10:26:35+00:00"
updated_at: "2026-11-04T10:28:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94460", "first_seen_at": "2026-11-04T10:26:35+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:28:27+00:00"}]
---

# IRISPowerscan: default installation account has elevated privileges and a predictable password

IRISPowerscan ships with a built-in installation account that has elevated privileges and a predictable password. An attacker can use it to gain unauthorised access to privileged application functions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the IRISPowerscan installation still has the built-in installation account enabled with its default password; ask I.R.I.S. support for the account name and affected versions (not published in the sources read). Per the CVSS vector, exposure is via the adjacent network, so also check which hosts on the same network can reach IRISPowerscan Server/Client.

## Timeline

- 2026-11-04T10:26:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94460
- 2026-11-04T10:28:27+00:00 analyst — Only the NVD record found (CVSS 4.0 vector AV:A, i.e. adjacent network, PR:N). No I.R.I.S./vendor advisory, affected versions, fix or account name located after two searches; nothing verified. Fix status left as is: no vendor page says unfixed. To settle: I.R.I.S. partner portal / support advisory.

## Documents

- [describes] NVD CVE-2026-94460 https://nvd.nist.gov/vuln/detail/CVE-2026-94460

## From the sources

IRISPowerscan contain an insecure default
configuration where the built-in installation account is assigned elevated
privileges with a predictable password, which could allow an unauthenticated
attacker to gain unauthorised access to privileged application functionality.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_