CVE-2026-109812

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

Published: 10/16/2026Modified: 10/16/2026

Related Intelligence (1)

CRITICALPhishing

Moxa AIG-302 ThingsPro Edge

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information.</strong></p> <p>The following versions of Moxa AIG-302 ThingsPro Edge are affected:</p> <ul> <li>Moxa AIG-302 Thing

CVE-2026-109812CVE-2026-109813
CISA Advisories

References (1)

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products