A critical authentication and authorization bypass vulnerability in the Tata Consultancy Services Cognix Recon Client allows remote, unauthenticated attackers to access restricted application functions.

This vulnerability consists of missing authentication and authorization checks within the web API, which permits any unauthenticated remote attacker to interact with sensitive application features via the network.

Successful exploitation allows unauthorized parties to interact with internal application logic without any credentials, potentially leading to significant information disclosure or unauthorized data manipulation. With a CVSS score of 7.5, this high-severity flaw poses a substantial risk to operational integrity and data confidentiality for organizations utilizing the Cognix platform.

Immediate Action: Restrict network access to the affected web API via firewall rules or VPNs until an official vendor patch is released and applied.

Proactive Monitoring: Review web server and API access logs for anomalous requests or traffic patterns originating from unauthorized or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block unauthorized requests to the Cognix Recon Client API endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists in the referenced GitHub repository (https://github.com/aksalsalimi/CVE-2026-26418).

Given the exposure of critical API functions to unauthenticated attackers and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Administrators should prioritize network-level isolation of the affected service immediately and coordinate with Tata Consultancy Services to obtain and deploy security updates as soon as they become available.