CVE-2026-65310
High
Description
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.
SeverityHigh
CVSS7.5
Exploit probability—
ProductHIPASE-250
PublishedJul 31, 2026
First seenJul 31, 2026
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ANDRITZ HIPASE-250 | v ≤ 7.20 | — |
| ANDRITZ 250 SCALA | v ≤ 7.20 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.