Is CVE-2026-33892 actively exploited?

No active exploitation of CVE-2026-33892 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33892 be exploited remotely?

Yes. CVE-2026-33892 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33892?

CVE-2026-33892 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-33892

HIGH

CVE-2026-33892

CWE-305Published: April 14, 2026· Updated: Apr 17, 2026

7.1

CVSS v3.1

EPSS:0.07%probability of exploitation in 30 daysPercentile:21.1th

Official Description

A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected management systems do not properly enforce user authentication on remote connections to devices.

This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user.

Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device.

Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.

NVD Source

Technical Analysis

CVE-2026-33892 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionRequired

ScopeChanged

Impact

ConfidentialityLow

IntegrityLow

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-33892

Siemens Industrial Edge Management

CISA Alerts· Apr 21, 2026

View CSAF Summary Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Industrial Edge Management are affected: Industrial Edge Management Pro V1 vers:intdot/>=1.7.6| =2.0.0| =2.2.0|<2.8.0 (CVE-2026-33892) CVSS Vendor Equipment Vulnerabilities v3 7.1 Siemens Siemens Industrial Edge Management Authentication Bypass by Primary Weakness Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas [xlite_meta score:63 src:CISA Alerts xlite_fp:9e73e5e8f057790bad502aab00896aa81a43168ae04bc0a125366cd91b0fdea9]