Executive Summary

The vulnerability in CVE-2026-26418 is due to missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client version 3.0.

Specifically, certain API endpoints such as /reconciliations/, /Scheduler/, and /DynamicReport/ did not enforce proper authentication and authorization controls.

This flaw allows remote attackers to access application functionality without any restriction or validation, meaning they can use the application features without proving their identity or having permission.

The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow remote attackers to access and use application functions without any restriction, potentially leading to unauthorized actions within the application.

Because there is no authentication or authorization enforced, attackers could manipulate or retrieve sensitive data, disrupt services, or perform actions that should be limited to authorized users only.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the web API endpoints of Tata Consultancy Services Cognix Recon Client v3.0 are accessible without authentication or authorization. Specifically, the endpoints to test are:

• http://clientreconhost/reconciliations/
• http://clientreconhost/Scheduler/
• http://clientreconhost/DynamicReport/

You can use commands like curl to test access to these endpoints without credentials. For example:

• curl -v http://clientreconhost/reconciliations/
• curl -v http://clientreconhost/Scheduler/
• curl -v http://clientreconhost/DynamicReport/

If these endpoints respond with data or functionality without requiring authentication, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing authentication and authorization on the affected API endpoints to prevent unauthorized access.

Since Tata Consultancy Services has already implemented corrective measures by February 4, 2026, you should ensure your Cognix Recon Client v3.0 installation is updated with the latest patches or versions that include these fixes.

Additionally, restrict network access to the vulnerable API endpoints by using firewall rules or network segmentation to limit exposure until the patch is applied.

Useful 0 Not Useful 0