Is CVE-2026-31846 actively exploited?

No active exploitation of CVE-2026-31846 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-31846 be exploited remotely?

Partially. CVE-2026-31846 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-31846?

CVE-2026-31846 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-31846

MEDIUM

CVE-2026-31846

CWE-306Published: March 23, 2026· Updated: Mar 26, 2026

6.5

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.2th

Official Description

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. The endpoint returns a raw response containing parameters such as Login_PW, which is Base64-encoded. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

NVD Source

Technical Analysis

CVE-2026-31846 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.