CVE-2026-18783: Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES
Published Sep 30, 2026
·Updated
Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass.
This issue affects Trex MES: through 2026-09-29.
Affected Software
1 affected component
Trex Digital Smart Manufacturing Systems Trex MES
Event History
Sep 30, 2026
CVE Published
via MITRE·02:12 PM
Data Sourced
via MITRE·02:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:22 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need valid credentials or user interaction to exploit this issue?
No. The supplied CVSS vector indicates no privileges are required and no user interaction is needed.
2
Is exploitation limited to local access?
No. The supplied CVSS vector identifies an adjacent-network attack vector, so an attacker must be on a network adjacent to the affected Trex MES deployment.
3
What impact could successful exploitation have?
The supplied CVSS vector rates confidentiality, integrity, and availability impact as high.