CVE-2026-1495: PI to CONNECT Information Disclosure Flaw

CVE-2026-1495 Overview

CVE-2026-1495 is an information disclosure vulnerability that allows attackers with Event Log Reader privileges (S-1-5-32-573) to extract sensitive proxy configuration details, including URLs and credentials, from PI to CONNECT event log files. This vulnerability stems from improper handling of sensitive information in log files (CWE-532), where proxy credentials are inadvertently stored in accessible event logs.

Critical Impact

Successful exploitation could enable unauthorized access to proxy servers, potentially allowing attackers to pivot through network infrastructure or intercept sensitive communications.

Affected Products

• PI to CONNECT components with event logging enabled
• Systems where Event Log Reader group membership is granted to untrusted users
• Environments utilizing proxy authentication for PI connectivity

Discovery Timeline

• 2026-02-10 - CVE-2026-1495 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-1495

Vulnerability Analysis

This vulnerability represents a classic case of sensitive data exposure through log files. The PI to CONNECT component writes proxy configuration details, including authentication credentials, to Windows event logs without proper redaction or encryption. Users who are members of the Event Log Reader group (identified by SID S-1-5-32-573) can access these logs through standard Windows event log interfaces.

The local attack vector requires the attacker to have authenticated access to the target system with Event Log Reader privileges. While this privilege level is commonly granted for legitimate monitoring purposes, it creates an unintended pathway to credential harvesting when combined with this logging deficiency.

Root Cause

The root cause is CWE-532: Insertion of Sensitive Information into Log File. The application fails to sanitize or mask sensitive proxy credentials before writing diagnostic information to event logs. This design flaw results in plaintext or easily recoverable credential information being persisted in locations accessible to users with log reading capabilities.

Attack Vector

The attack requires local access to the affected system with Event Log Reader group membership. An attacker would:

1. Authenticate to the target system with credentials that have Event Log Reader privileges
2. Access the Windows Event Viewer or use PowerShell cmdlets to query event logs
3. Search for PI to CONNECT related events containing proxy configuration data
4. Extract proxy URLs and credentials from the log entries
5. Use harvested credentials to access the proxy server or perform further lateral movement

The vulnerability mechanism involves the application's logging subsystem capturing proxy connection details during PI to CONNECT operations. When proxy authentication is configured, the credentials are written to event logs as part of connection diagnostics or error reporting. For detailed technical information, refer to the CISA ICS Advisory ICSA-26-041-04.

Detection Methods for CVE-2026-1495

Indicators of Compromise

• Unusual access patterns to Windows Security or Application event logs by non-administrative accounts
• PowerShell commands querying event logs for PI-related entries such as Get-WinEvent with PI-related filters
• Event log export operations from systems hosting PI to CONNECT components
• Suspicious proxy authentication attempts using credentials not associated with normal service accounts

Detection Strategies

• Monitor Windows Security Event ID 4663 for event log file access by Event Log Reader group members
• Implement SIEM rules to detect bulk event log queries targeting PI application logs
• Track authentication anomalies on proxy servers that may indicate use of harvested credentials
• Deploy endpoint detection rules for PowerShell scripts accessing event logs in automated fashion

Monitoring Recommendations

• Enable enhanced auditing for event log access on systems running PI to CONNECT
• Configure alerts for Event Log Reader group membership changes
• Implement User and Entity Behavior Analytics (UEBA) to detect credential misuse patterns
• Review proxy server authentication logs for connections from unexpected sources

How to Mitigate CVE-2026-1495

Immediate Actions Required

• Audit Event Log Reader group membership and remove unnecessary users
• Review and clear existing event logs that may contain exposed credentials
• Rotate all proxy credentials that may have been logged
• Restrict network access to proxy servers to known, authorized systems

Patch Information

Consult the CISA ICS Advisory ICSA-26-041-04 for official vendor patch information and updated software versions that address the sensitive information logging issue. Apply vendor-provided updates that implement proper credential redaction in logging operations.

Workarounds

• Remove Event Log Reader privileges from users and groups that do not require log access for legitimate purposes
• Implement proxy authentication using service accounts with limited permissions and regular credential rotation
• Configure log retention policies to minimize the exposure window of logged credentials
• Deploy network segmentation to limit the impact of potential proxy credential compromise
• Consider disabling detailed logging for PI to CONNECT until patches are applied

# Configuration example: Audit Event Log Reader group membership
# PowerShell command to review current group members
Get-LocalGroupMember -Group "Event Log Readers"

# Remove unnecessary users from Event Log Readers group
Remove-LocalGroupMember -Group "Event Log Readers" -Member "DOMAIN\UntrustedUser"

# Enable auditing for event log access
auditpol /set /subcategory:"File System" /success:enable /failure:enable