Security readout for executives and security teams
Plain-English summary
CVE-2026-22096 is a critical missing-authentication issue in the EVbee DC-80 webserver on port 8090. An unauthenticated network user may access sensitive information, including configured passwords, or upload files through exposed endpoints. Business risk is high where these systems are reachable from untrusted networks.
Executive priority
Prioritize this as an urgent exposure-reduction item for any EVbee DC-80 reachable outside a tightly controlled management network. The main decision is not whether exploitation is confirmed, but whether unauthenticated access to sensitive device functions is possible in your environment.
Technical view
The CVE describes CWE-306: webserver endpoints on port 8090 do not require authentication. CVSS 4.0 is 9.3 critical with network attack vector, low complexity, no privileges, and no user interaction. The source names EVbee DC-80 with version value 0; product/version detail appears limited.
Likely exposure
Exposure is most likely for organizations running EVbee DC-80 where port 8090 is reachable from the internet, partner networks, or broad internal networks. The bundle does not provide scan data, default deployment posture, or a complete affected-version range.
Exploitation context
The source bundle does not report active exploitation, and KEV status is false. However, the described condition is remotely reachable, unauthenticated, and could expose passwords or allow file uploads, so exposed systems should be treated as urgent until vendor guidance clarifies fixes.
Researcher notes
Evidence is sufficient for impact classification but limited on affected versions and remediation. The version field is listed as 0, and no vendor patch is named in the bundle. Avoid expanding scope beyond EVbee DC-80 unless additional sources confirm other products.
Mitigation direction
- Check EVbee and DIVD guidance for confirmed fixes or mitigations.
- Restrict access to port 8090 to trusted administrative networks only.
- Remove any internet exposure for affected DC-80 web interfaces.
- Rotate configured passwords if exposure of endpoints is confirmed.
- Review uploaded files and device configuration for unauthorized changes.
Validation and detection
- Inventory EVbee DC-80 deployments and ownership.
- Identify whether TCP port 8090 is reachable from untrusted networks.
- Confirm management endpoints require authentication after mitigation or patching.
- Review logs and configuration for unexpected access or file uploads.
- Track CVE and DIVD updates for affected-version and remediation changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22096 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——DIVDVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://csirt.divd.nl/DIVD-2026-00001/CVE reference, DIVD · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.