CVE-2026-36035

Deferred Deferred - Pending Action

Incorrect Access Control in UniversalPlantViewer WebServices Server

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: MITRE

Description

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the license from the webserver.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-36035

EUVD

EUVD-2026-44578

Affected Vendors & Products

Vendor	Product	Version / Range
caxperts	universalplantviewer	2.7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an incorrect access control issue in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6. It allows authenticated attackers with low-level privileges to cause a Denial of Service by removing the license from the webserver.

Detection Guidance

To detect this vulnerability, monitor for unauthorized access attempts to the /api/License/deactivateOffline endpoint. Check web server logs for POST requests with low-privilege user sessions attempting to deactivate licenses. Verify if the endpoint responds with a successful license removal, which could indicate exploitation.

Impact Analysis

If exploited, this vulnerability could allow attackers to disrupt the availability of the CAXPerts UniversalPlantViewer WebServices Server by removing its license, leading to service unavailability for legitimate users.

Mitigation Strategies

Immediately restrict access to the /api/License/deactivateOffline endpoint to authorized personnel only. Review and update user permissions to ensure low-level users cannot access sensitive functions. Consider disabling the endpoint if not required for operations.

Hi! I’m here to help you understand CVE-2026-36035. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70