CVE-2026-57913: J&J ATMS Information Disclosure Flaw

CVE-2026-57913 Overview

CVE-2026-57913 is an information disclosure vulnerability in the Johnson & Johnson Audit Tracking Management System (ATMS) prior to the 2026-04-21 build. The flaw allows unauthenticated network attackers to view meeting minutes and transcripts that should be restricted to authorized users. The weakness is classified as [CWE-602] Client-Side Enforcement of Server-Side Security, meaning access controls intended to protect sensitive content were implemented in the client rather than on the server. The vulnerability affects confidentiality only, with no direct impact on integrity or availability.

Critical Impact
Remote, unauthenticated attackers can retrieve internal audit meeting minutes and transcripts, exposing potentially sensitive corporate audit content.

Affected Products

Johnson & Johnson Audit Tracking Management System (ATMS) versions before the 2026-04-21 release

Discovery Timeline

2026-06-26 - CVE-2026-57913 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57913

Vulnerability Analysis

The Johnson & Johnson Audit Tracking Management System (ATMS) is a web application used to manage internal audit activities, including scheduling, minutes, and transcripts. Prior to the 2026-04-21 build, the application exposed meeting minutes and transcript content to callers who did not hold the required authorization on the server side. An unauthenticated remote attacker interacting with the application over the network can retrieve this content directly.

The vulnerability results in disclosure of confidential audit material without altering data or degrading service availability. Because exposed content includes meeting minutes and transcripts, disclosure may reveal auditor findings, participant identities, and internal control discussions.

Root Cause

The root cause is [CWE-602] Client-Side Enforcement of Server-Side Security. The application relied on the front-end to hide, filter, or restrict access to meeting minutes and transcripts. The server-side endpoints returning that data did not re-validate the caller's authorization. An attacker who bypasses the client interface, for example by calling backend APIs directly or manipulating requests, receives the underlying content without server-side enforcement.

Attack Vector

Attack proceeds over the network against the ATMS web endpoints. No authentication, privileges, or user interaction are required. An attacker enumerates or requests the resource paths that return meeting minutes and transcripts, and the server responds with the protected data. Details of the specific request patterns are documented in the Eaton Works blog post on J&J web application hacks.

No verified proof-of-concept code is included in the NVD entry, and no synthetic exploitation code is provided here.

Detection Methods for CVE-2026-57913

Indicators of Compromise

Unauthenticated HTTP requests to ATMS API endpoints returning 200 OK responses with meeting minute or transcript payloads.
Access to backend content URLs from source IP addresses that never authenticated to the ATMS portal.
Anomalous bulk enumeration of sequential resource identifiers against ATMS endpoints.

Detection Strategies

Review web server and application logs for direct calls to minute or transcript endpoints that bypass the ATMS login flow.
Correlate authentication events with content-access events to flag content retrieval by sessions lacking a prior authenticated login.
Alert on high-volume identifier enumeration patterns against ATMS URIs, which indicate scraping of restricted content.

Monitoring Recommendations

Enable verbose access logging on the ATMS reverse proxy or web application firewall (WAF) and retain logs for post-incident review.
Forward ATMS access logs to a centralized SIEM or data lake for correlation with authentication telemetry.
Establish baselines for normal transcript and minutes retrieval volume, and alert on deviations.

How to Mitigate CVE-2026-57913

Immediate Actions Required

Upgrade Johnson & Johnson ATMS to the build released on or after 2026-04-21.
Restrict network exposure of the ATMS application to trusted internal networks or VPN users until patching is complete.
Review access logs for unauthenticated retrieval of meeting minutes and transcripts since the application was deployed.

Patch Information

Johnson & Johnson resolved the issue in the ATMS build dated 2026-04-21. Administrators should confirm their instance is on that build or later. Additional context is available in the Eaton Works blog post on J&J web application hacks.

Workarounds

Place the ATMS application behind an authenticating reverse proxy that enforces session validation before backend requests are forwarded.
Apply WAF rules that block unauthenticated requests to endpoints returning transcript or meeting minute content.
Temporarily disable public-facing routes to transcript and minutes endpoints until the patched build is deployed.

bash

# Example NGINX rule enforcing authentication before ATMS content endpoints
location ~* ^/atms/(minutes|transcripts)/ {
    auth_request /_auth;
    error_page 401 = @unauthorized;
    proxy_pass http://atms_backend;
}

location @unauthorized {
    return 401;
}