Default Password Vulnerability in AxxonSoft Axxon One Web Client
CVE-2026-121022

9.2CRITICAL

Key Information:

Vendor

Axxonsoft

Status
Axxon One
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121022?

A vulnerability exists in the web client of AxxonSoft Axxon One prior to version 3.0.0, where the application fails to enforce a mandatory password change on initial login. This oversight allows remote attackers to gain unauthorized access by utilizing the default credentials. The lack of enforced security measures makes newly installed systems particularly susceptible, as attackers could log in as the built-in administrator without any authentication.

Affected Version(s)

Axxon One Windows 0 < 3.0.0

References

https://www.axxonsoft.com/legal/axxonsoft-vulnerability-d...
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered internally by the AxxonSoft QA team.
.