Vulnerability · Published Apr 9, 2026 · Assigned by CERT-PL

CVE-2026-4901Insertion of Sesitive Information into Log File in AlanWeb SCADA

Medium 6.9

In plain English

A medium-severity sensitive data in logs in AlanWeb SCADA from Control System. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5

Affected products (as reported)

Vendor	Product	Versions
Control System	AlanWeb SCADA	0 – before 9.8.5

Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/posts/2026/04/CVE-2026-4901/ third-party-advisory
https://control-system.pl/ product