CVE-2026-22096 | The webserver running on port 8090 does not require authenti… | CVSS 9.3 CRITICAL

Description

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

Metadata

CVE ID: CVE-2026-22096
State: PUBLISHED
Assigner: DIVD
Reserved: 2026-01-06 11:08 UTC
Published: 2026-07-13 09:10 UTC
Last updated: 2026-07-13 14:25 UTC
Primary CWE: CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product: EVbee / DC-80
Sources: cve.org · NVD

Severity & Metrics

9.3 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
EVbee	DC-80	—	0 < 1.5.1

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306 Missing Authentication for Critical Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (1)

https://csirt.divd.nl/DIVD-2026-00001/