CVE-2026-94460: IRISPowerscan Insecure default privilege assignment for installation account
Published Nov 4, 2026
·Updated
IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality.
Event History
Nov 4, 2026
CVE Published
via MITRE·09:12 AM
Data Sourced
via MITRE·09:12 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker does not need to authenticate or interact with a user. Exploitation relies on the built-in installation account having elevated privileges and a predictable password.
2
Is the default configuration affected?
Yes. The issue is described as an insecure default configuration in which the built-in installation account receives elevated privileges.
3
What access could an attacker gain?
An attacker could gain unauthorized access to privileged application functionality through the installation account.