CVE-2026-41993 Overview
CVE-2026-41993 is an Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products. A local attacker with administrator privileges can bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker must stage an unauthorized file on the removable media before exploitation.
The flaw affects SafePortAgent versions before 3.2.5024 and StellarProtect versions from 3.2.4011 before 5.0.1083. TXOne Networks products are widely deployed across operational technology (OT) and industrial control system (ICS) environments, where removable media controls form a core security boundary.
Critical Impact
Attackers with administrator privileges can transfer unauthorized files past the file lockdown mechanism, undermining removable media enforcement on OT endpoints.
Affected Products
- TXOne Networks SafePortAgent before 3.2.5024
- TXOne Networks StellarProtect from 3.2.4011 before 5.0.1083
- Endpoints relying on TXOne file lockdown for removable media validation
Discovery Timeline
- 2026-07-17 - CVE-2026-41993 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-41993
Vulnerability Analysis
The vulnerability resides in the Removable Media Validation function, which is responsible for enforcing file lockdown policies when USB drives or other removable media are attached to a protected endpoint. Under normal operation, this control blocks unauthorized executables and data files from being transferred onto the device.
The access control logic fails to fully validate file transfers when the operation is initiated by a user holding administrator privileges. An attacker who has staged malicious or policy-violating files on removable media in advance can move those files onto the endpoint despite the lockdown policy.
Because TXOne agents typically protect industrial and OT assets, a bypass of removable media enforcement removes a key control designed to prevent insider misuse and physical-access attacks. The vulnerability is classified as Improper Access Control and affects the integrity of the protected host.
Root Cause
The root cause is insufficient authorization checks within the file lockdown workflow. The validation function trusts administrator context to a degree that permits bypassing removable media policy, rather than enforcing the lockdown as a policy control independent of the local user's privilege level.
Attack Vector
Exploitation requires local access and administrator privileges on the endpoint. The attacker prepares unauthorized files on the removable media out-of-band, connects the media to the target device, and then leverages the flawed validation path to write files that the lockdown policy should have blocked. No user interaction is required beyond the attacker's own actions on the compromised host.
Refer to the TXOne Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-41993
Indicators of Compromise
- Unexpected file writes on endpoints correlated with removable media insertion events for SafePortAgent or StellarProtect protected hosts.
- Presence of files on OT endpoints that were not delivered through the sanctioned software distribution or approved removable media workflow.
- Removable media policy events logged by TXOne agents showing administrator-initiated transfers that succeeded despite lockdown being enforced.
Detection Strategies
- Correlate USB or removable media insertion events with subsequent file creation events on protected endpoints.
- Alert on new executable, script, or archive files appearing on TXOne-protected hosts outside of approved change windows.
- Audit administrator account activity on OT endpoints for signs of interactive local logons followed by file transfers from removable devices.
Monitoring Recommendations
- Forward TXOne agent logs and Windows removable storage events (Event IDs 6416, 4663) to a centralized SIEM for correlation.
- Baseline expected removable media activity per site and flag deviations, especially on assets that should not accept USB writes.
- Continuously monitor version inventory to confirm SafePortAgent and StellarProtect agents are running fixed builds.
How to Mitigate CVE-2026-41993
Immediate Actions Required
- Upgrade SafePortAgent to version 3.2.5024 or later on all protected endpoints.
- Upgrade StellarProtect to version 5.0.1083 or later where the installed version falls in the affected range starting at 3.2.4011.
- Restrict local administrator privileges on OT endpoints to a minimal, audited set of accounts.
- Physically restrict access to removable media ports on production ICS assets where feasible.
Patch Information
TXOne Networks addressed the issue in SafePortAgent 3.2.5024 and StellarProtect 5.0.1083. Consult the TXOne Security Advisory for full remediation guidance and download links.
Workarounds
- Enforce strict administrator access controls and require multi-person authorization for OT endpoint logons.
- Disable USB and removable media ports through hardware or Group Policy where operationally acceptable until agents are patched.
- Deploy compensating monitoring that alerts on any file write following removable media insertion on affected hosts.
# Verify installed TXOne agent versions on Windows endpoints
wmic product where "Name like 'StellarProtect%%'" get Name,Version
wmic product where "Name like 'SafePortAgent%%'" get Name,Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
