CVE-2026-63248

MEDIUM 6.9 ALL-YEARS

Published 2026-08-04 · Last modified 2026-08-04 · eclipse · NVD: Analyzed

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 18th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

6.9CVSS 4.0 · MEDIUM · CNA

ConfidentialityLow
IntegrityLow
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Eclipse Foundation Eclipse

Products Eclipse Milo Milo

Weakness (CWE)

CWE-862: Missing authorization

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References and research data (JSON)

Known Affected Software Configurations

Vendor	Product	Version range
Eclipse	Milo	≥ 0.6.0 and < 1.1.5

All CVSS metrics

MEDIUM 6.9 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
MEDIUM 6.9 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MEDIUM 6.5 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Patches & mitigations

https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a PatchCVE record · eclipse · Updated 2026-08-04T12:07:43.820Z
NVD · CVE-2026-63248 · Updated 2026-10-23T23:10:00.157
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/181 Issue TrackingPatchVendor AdvisoryCVE record · eclipse · Updated 2026-08-04T12:07:43.820Z
NVD · CVE-2026-63248 · Updated 2026-10-23T23:10:00.157

Advisories

https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598 Issue TrackingVendor AdvisoryCVE record · eclipse · Updated 2026-08-04T12:07:43.820Z
NVD · CVE-2026-63248 · Updated 2026-10-23T23:10:00.157
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52664 ADVISORYEUVD · EUVD-2026-52664

Sources: NVD · CVE.org · All sources and attribution · EPSS