CVE-2026-36035: UniversalPlantViewer DoS Vulnerability

CVE-2026-36035 Overview

CVE-2026-36035 is an incorrect access control vulnerability in CAXPerts UniversalPlantViewer WebServices Server version 2.7.6. The flaw exists in the /api/License/deactivateOffline endpoint, which fails to enforce adequate authorization checks. Authenticated attackers holding low-level privileges can invoke this endpoint to remove the license from the webserver, producing a Denial of Service (DoS) condition. The weakness is classified under [CWE-284: Improper Access Control]. The vulnerability is network-exploitable and requires only low-privilege authentication, with no user interaction needed.

Critical Impact
A low-privileged authenticated user can strip the license from the UniversalPlantViewer WebServices Server, rendering the service unavailable to all legitimate users.

Affected Products

CAXPerts UniversalPlantViewer WebServices Server v2.7.6
Deployments exposing the /api/License/deactivateOffline endpoint
Environments where low-privilege user accounts can reach the WebServices API

Discovery Timeline

2026-07-14 - CVE-2026-36035 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-36035

Vulnerability Analysis

The vulnerability resides in the license management interface of the CAXPerts UniversalPlantViewer WebServices Server. Specifically, the /api/License/deactivateOffline endpoint accepts requests from any authenticated user regardless of role or privilege level. This endpoint is intended for administrative license lifecycle operations, such as offline deactivation during migrations or hardware changes. Because the server does not validate that the caller has administrative rights, any user with valid credentials can trigger deactivation. Once deactivated, the license is removed from the webserver and downstream functionality that depends on licensing becomes unavailable. The confidentiality and integrity of application data are not directly affected, but availability is severed for all consumers of the service.

Root Cause

The root cause is a missing authorization check on a privileged API route. The endpoint verifies authentication but does not enforce role-based access control (RBAC) before performing the license deactivation action. This aligns with [CWE-284: Improper Access Control], where the software fails to restrict access to a resource to authorized actors only.

Attack Vector

An attacker requires only network reachability to the WebServices Server and valid credentials for any low-privileged account. The attacker sends an HTTP request to the /api/License/deactivateOffline endpoint, triggering license removal. No social engineering, user interaction, or elevated privileges are needed. The action can be repeated to prevent recovery after an administrator reinstates the license, effectively sustaining the outage.

No verified public exploit code is available for CVE-2026-36035. Technical background is described in the Medium disclosure post by the reporting researcher.

Detection Methods for CVE-2026-36035

Indicators of Compromise

HTTP requests targeting the /api/License/deactivateOffline endpoint originating from non-administrative user sessions
Sudden loss of licensed functionality on UniversalPlantViewer WebServices Server v2.7.6 without a corresponding administrative change record
License state transitions logged outside of scheduled maintenance windows

Detection Strategies

Enable and centralize web server access logs for all requests to /api/License/* routes, then alert on any invocation of deactivateOffline by non-admin accounts
Correlate authentication events with license-modifying API calls to identify unauthorized activity
Baseline expected administrative sources for license operations and flag deviations by source IP or user agent

Monitoring Recommendations

Forward CAXPerts WebServices logs to a centralized logging or SIEM platform for retention and analysis
Configure real-time alerts for HTTP 200 responses on the deactivation endpoint
Monitor service health probes for sudden license-related error codes that indicate deactivation has occurred

How to Mitigate CVE-2026-36035

Immediate Actions Required

Restrict network access to the UniversalPlantViewer WebServices Server so that only trusted administrative workstations can reach license management endpoints
Audit all existing accounts on the server and remove or downgrade any that do not require access
Rotate credentials for low-privileged accounts that could reach the vulnerable endpoint
Contact CAXPerts for a fixed release or vendor-supplied guidance beyond version 2.7.6

Patch Information

At the time of publication, no vendor patch is listed in the NVD entry for CVE-2026-36035. Administrators should consult the CAXPerts vendor site and the UniversalPlantViewer product page for updated releases addressing this issue.

Workarounds

Place a reverse proxy or web application firewall (WAF) in front of the WebServices Server and block requests to /api/License/deactivateOffline from non-administrative source ranges
Enforce network segmentation so the WebServices API is not reachable by general end-user populations
Implement compensating monitoring to detect license removal and trigger automated reactivation procedures where supported

bash

# Example nginx reverse proxy rule to restrict the vulnerable endpoint
location = /api/License/deactivateOffline {
    allow 10.0.10.0/24;   # Admin workstation subnet
    deny  all;
    proxy_pass http://upv-webservices-backend;
}