CORS Misconfiguration in Network Optix Nx Witness VMS

CVE-2026-10056

What is CVE-2026-10056?

A CORS misconfiguration in the REST API of Network Optix Nx Witness VMS prior to version 6.1.2, when in the default Standard security mode, poses a risk of session token theft. An attacker can exploit this vulnerability by manipulating a malicious cross-origin web page, targeting authenticated users to gain unauthorized access to their session tokens. This flaw facilitates potential administrator account takeover. To mitigate this risk, users should update to version 6.1.2 or set Access-Control-Allow-Credentials to false in existing installations.

References