CVE-2026-4760: Panorama Web HMI Information Disclosure Flaw

CVE-2026-4760 Overview

CVE-2026-4760 is a high-severity arbitrary file read vulnerability affecting Codra Panorama Web HMI. An attacker can gain unauthorized read access to certain Web HMI server files if they know the file paths and those files are accessible to the Servin process execution account. This vulnerability falls under CWE-552 (Files or Directories Accessible to External Parties) and poses significant risks to industrial control system environments where Panorama Suite is deployed.

Critical Impact

Attackers with network access can read sensitive server files without authentication, potentially exposing configuration data, credentials, or other sensitive information stored on the Web HMI server.

Affected Products

• Panorama Suite 2022-SP1 (22.50.005) - vulnerable unless update PS-2210-02-4079 or higher is installed
• Panorama Suite 2023 (23.00.004) - vulnerable unless updates PS-2300-03-3078, PS-2300-04-3078, and PS-2300-82-3078 or higher are installed
• Panorama Suite 2025 (25.00.016) - vulnerable unless updates PS-2500-02-1078 and PS-2500-04-1078 or higher are installed
• Panorama Suite 2025 Updated Dec. 25 (25.10.007) - vulnerable unless updates PS-2510-02-1077 and PS-2510-04-1077 or higher are installed

Discovery Timeline

• 2026-03-25 - CVE-2026-4760 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4760

Vulnerability Analysis

This vulnerability allows remote attackers to read arbitrary files from the Panorama Web HMI server through the web interface. The exploitation requires the attacker to know or guess valid file paths on the target system. Files that are accessible to the Servin process execution account can be read by exploiting this flaw.

The vulnerability stems from improper access controls in the Web HMI component, allowing file read operations outside the intended scope. In industrial control system (ICS) environments where Panorama Suite is commonly deployed, this could lead to exposure of process configurations, system credentials, or operational data.

Root Cause

The root cause is classified under CWE-552 (Files or Directories Accessible to External Parties). The Panorama Web HMI server fails to properly validate and restrict file access requests, allowing attackers to read files that should not be accessible through the web interface. The vulnerability affects the Servin process, which handles web requests and has file system access permissions that can be abused.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability remotely by sending crafted requests to the Web HMI server. The attack complexity is low, requiring only knowledge of file paths on the target system.

The exploitation process involves:

1. Identifying a vulnerable Panorama Web HMI instance exposed to the network
2. Crafting HTTP requests that specify paths to sensitive files
3. Receiving file contents in the server response if the file is accessible to the Servin process

For detailed technical information, refer to the Codra CSIRT Security Bulletin BS-035.

Detection Methods for CVE-2026-4760

Indicators of Compromise

• Unusual file access patterns in Web HMI server logs
• HTTP requests containing path traversal sequences or references to sensitive system files
• Unexpected read operations on configuration files or credential stores by the Servin process
• Network traffic anomalies indicating data exfiltration from the HMI server

Detection Strategies

• Monitor Web HMI access logs for requests targeting sensitive file paths outside normal application directories
• Implement network-level detection for HTTP requests containing path traversal patterns
• Deploy file integrity monitoring on the Panorama Web HMI server to detect unauthorized file access
• Review Servin process activity for anomalous file read operations

Monitoring Recommendations

• Enable detailed logging on the Panorama Web HMI server and centralize log collection
• Configure alerts for file access attempts targeting system configuration directories
• Implement network segmentation to limit exposure of HMI servers and monitor cross-segment traffic
• Deploy endpoint detection and response (EDR) solutions on systems running Panorama Suite

How to Mitigate CVE-2026-4760

Immediate Actions Required

• Apply the appropriate security updates for your Panorama Suite version immediately
• Restrict network access to the Web HMI server to authorized users and systems only
• Review file system permissions for the Servin process execution account and apply principle of least privilege
• Audit recent access logs for signs of exploitation

Patch Information

Codra has released security updates to address this vulnerability. Apply the following patches based on your Panorama Suite version:

Refer to the Codra CSIRT website and security bulletin BS-035 for detailed patch instructions.

Workarounds

• Implement network segmentation to isolate HMI servers from untrusted networks
• Deploy a web application firewall (WAF) to filter malicious requests targeting file paths
• Restrict the Servin process account permissions to minimize accessible files
• Disable or restrict access to the Web HMI interface if not operationally required until patches can be applied
• Monitor and log all access to the Web HMI server for forensic purposes

# Network segmentation example - restrict HMI server access
# Only allow connections from trusted management networks
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP