CVE-2026-121024: Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet

Published Nov 3, 2026

Updated

Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.

Event History

Nov 3, 2026

CVE Published

via MITRE·08:48 AM

Data Sourced

via MITRE·08:48 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

AxxonSoft AxxonNet deployments on Linux before version 3.28.0 are affected when a shared report token is available to a remote attacker. The issue is in the Health Monitoring service.

What does an attacker need to exploit it?

The attacker needs possession of a shared report token intended to provide read-only access. No additional user interaction is required.

What actions can an attacker perform with the token?

An attacker can use the monitoring API to create, modify, or delete monitoring alerts. The provided impact information indicates integrity and availability effects, not confidentiality impact.

CVE-2026-121024: Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What actions can an attacker perform with the token?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What actions can an attacker perform with the token?