CVE-2026-19438 Overview
CVE-2026-19438 is a path traversal vulnerability affecting ABB Mint Workbench I through build 5876. The flaw stems from improper limitation of a pathname to a restricted directory, classified under [CWE-22]. A local attacker with no privileges can leverage the flaw to access files outside intended directories. Exploitation requires no user interaction and can lead to disclosure of sensitive files on the host system. ABB Mint Workbench is engineering software used to configure and program ABB motion control drives, making the software common on operational technology (OT) workstations.
Critical Impact
Local attackers can read files outside the application's intended directory scope, exposing sensitive configuration data on engineering workstations used to program industrial motion controllers.
Affected Products
- ABB Mint Workbench I through version 5876
Discovery Timeline
- 2026-09-23 - CVE CVE-2026-19438 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-19438
Vulnerability Analysis
CVE-2026-19438 is a path traversal weakness in ABB Mint Workbench I. The software fails to properly sanitize file path inputs before resolving them against the filesystem. This allows an attacker to traverse outside the intended working directory using sequences such as ..\ or absolute paths. The impact is scoped to confidentiality of files accessible to the process, with a scope change indicating that traversal reaches resources beyond the vulnerable component.
Because Mint Workbench runs on engineering workstations connected to industrial motion controllers, exposed files can include project files, drive configuration data, and credentials cached by the tool. The EPSS probability is approximately 0.27%, reflecting current absence of public exploit code.
Root Cause
The root cause is missing or insufficient input validation on file path parameters processed by Mint Workbench I. The application constructs filesystem paths from attacker-controllable input without canonicalizing the result and validating that it remains within an allowed base directory. This class of flaw is tracked under [CWE-22].
Attack Vector
Exploitation requires local access to a system running Mint Workbench I through build 5876. The attack complexity is low and no authentication or user interaction is required to trigger the flaw. An attacker supplies a crafted pathname containing traversal sequences to a component that opens or reads files. The resolver follows the traversal, returning contents of files outside the restricted directory to the attacker.
No verified proof-of-concept code is publicly available. Refer to the ABB security advisory for vendor technical details.
Detection Methods for CVE-2026-19438
Indicators of Compromise
- File access events originating from Mint Workbench processes targeting paths containing ..\, ../, or absolute paths outside the installation directory.
- Unexpected reads of sensitive Windows files such as C:\Windows\System32\config\SAM or user profile files by the Mint Workbench executable.
- Mint Workbench process activity on engineering workstations outside scheduled maintenance windows.
Detection Strategies
- Deploy endpoint file-integrity and process-behavior monitoring on OT engineering workstations to flag Mint Workbench file reads outside its installation and project directories.
- Correlate process command-line arguments and file open events for path traversal patterns using EDR telemetry.
- Maintain a software inventory and alert when Mint Workbench I builds at or below 5876 are observed running.
Monitoring Recommendations
- Forward Windows Security and Sysmon file access events from engineering workstations to a centralized data lake for retention and query.
- Baseline normal Mint Workbench file access patterns and alert on deviations, particularly reads of user profile and system directories.
- Monitor local logon activity on OT workstations to detect the low-privilege access required for exploitation.
How to Mitigate CVE-2026-19438
Immediate Actions Required
- Identify all systems running ABB Mint Workbench I at build 5876 or earlier and restrict interactive access to authorized engineers.
- Apply the fixed version referenced in the ABB advisory as soon as it is available in your environment.
- Enforce least-privilege on engineering workstations so Mint Workbench does not execute under accounts with access to sensitive files.
Patch Information
ABB has published guidance for this issue. Review the ABB security advisory for the fixed version and remediation instructions. Upgrade Mint Workbench I to the version specified by the vendor.
Workarounds
- Restrict physical and remote console access to workstations running vulnerable Mint Workbench builds.
- Store sensitive files, credentials, and project data outside the accounts that run Mint Workbench, and apply strict NTFS ACLs.
- Segment engineering workstations from general IT networks and enforce jump-host access controls to reduce local attack surface.
- Disable or uninstall Mint Workbench on systems where it is not actively required until a patched version is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
