Vulnerability · Published Jan 15, 2026 · Assigned by SICK AG
CVE-2026-22646
Medium 4.3
In plain English
A medium-severity security flaw in Incoming Goods Suite from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information (like file paths, database errors, or software versions) that can be used to map the application's internal structure and discover other, more critical vulnerabilities.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SICK AG | Incoming Goods Suite | 0 – before 1.2.1 |
Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://sick.com/psirt x_SICK PSIRT Security Advisories
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.json x_The canonical URL.
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf vendor-advisory