CVE-2026-28698

Received Received - Intake

Exposure of Sensitive Information in Pronetiqs IntraVUE

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: ICS-CERT

Description

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-28698

Affected Vendors & Products

Vendor	Product	Version / Range
pronetiqs	intravue	to 3.2.1a14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

Pronetiqs IntraVUE versions 3.2.1a14 and prior expose sensitive system information to unauthorized users. This vulnerability allows attackers to access the underlying host or shared filesystem without proper authorization.

Detection Guidance

Detecting this vulnerability requires checking for exposed sensitive system information in Pronetiqs IntraVUE versions 3.2.1a14 or earlier. Review network traffic for unauthorized access to host/share filesystem data. Inspect IntraVUE logs for unusual file access patterns or system information exposure. Ensure no unauthorized users or systems can access IntraVUE interfaces or data paths.

Impact Analysis

An attacker could exploit this to view or steal sensitive data stored on the system, disrupt operations, or gain further access to connected networks. The high CVSS scores indicate significant risk of unauthorized access and data exposure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data exposure. Organizations may face legal penalties, fines, or reputational damage if sensitive data is compromised.

Mitigation Strategies

Immediately upgrade Pronetiqs IntraVUE to a version beyond 3.2.1a14. Restrict network access to IntraVUE interfaces using firewalls or network segmentation. Audit and remove any unauthorized user accounts or permissions. Monitor system logs for suspicious activity related to file access or system information exposure.

Hi! I’m here to help you understand CVE-2026-28698. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70