Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

iControl SOAP allows sensitive file download by authorized attackers

CVE-2026-42063 · published 5 months ago
Summary

iControl SOAP is vulnerable to unauthorized file downloads by attackers with high-level roles. This can lead to sensitive information being accessed. Update to a supported version of iControl SOAP to fix this issue.

Original advisory text
A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files.  Note: Software versions which have reach...
A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-552Files or Directories Accessible to External Parties
Timeline
Published13 May 2026
Updated3 Nov 2026
First seen13 May 2026
Sources
CVE-2026-42063 · NVD
Track software like this
Free during beta