CVE-2026-8359: NULL Pointer Dereference Vulnerability

CVE-2026-8359 Overview

CVE-2026-8359 is a null pointer dereference vulnerability [CWE-476] triggered when a web server processes HTTP requests with URL paths beginning with /status or /sysinfo. The server attempts to load WOSHttpStatusModule.dll to handle these paths and calls the WOSBin_LoadHttpModule function to initialize the module object. Because WOSHttpStatusModule.dll is absent from the installation, the function pointer resolves to NULL and the server invokes a function at address 0. A remote, unauthenticated attacker can crash the service by sending crafted requests, producing an availability impact.

Critical Impact
Unauthenticated remote attackers can crash the affected service by issuing HTTP requests to /status or /sysinfo URL paths.

Affected Products

Product details disclosed in the Tenable Security Research Advisory TRA-2026-45
No CPE entries listed in the National Vulnerability Database (NVD) at publication
Refer to the vendor advisory for impacted versions

Discovery Timeline

2026-05-27 - CVE-2026-8359 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8359

Vulnerability Analysis

The vulnerability resides in the HTTP request dispatch logic of the affected web server. When an incoming request URL begins with /status or /sysinfo, the server attempts to route the request to WOSHttpStatusModule.dll. The dispatcher calls WOSBin_LoadHttpModule to construct a module object that handles subsequent processing for these URL patterns.

Because WOSHttpStatusModule.dll is not shipped with the product installation, the dynamic loader cannot resolve the export. The function pointer that would normally reference WOSBin_LoadHttpModule in the DLL's export table remains NULL. The server then dereferences this null pointer and transfers execution to address 0x00000000, causing an access violation.

The defect maps to [CWE-476: NULL Pointer Dereference]. Confidentiality and integrity are not affected. The exploitation result is a denial of service, since the worker process terminates and disrupts service availability.

Root Cause

The root cause is missing validation of the function pointer returned during module resolution. The server assumes WOSHttpStatusModule.dll is present and that its exports can be loaded successfully. There is no fallback handler or null check before invoking the function pointer associated with the /status and /sysinfo URL handlers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the target server with any URL path beginning with /status or /sysinfo. The server attempts module dispatch, dereferences the NULL function pointer, and crashes. Repeated requests can sustain the denial of service condition.

For technical specifics, see the Tenable Security Research Advisory TRA-2026-45.

Detection Methods for CVE-2026-8359

Indicators of Compromise

HTTP access log entries containing request paths beginning with /status or /sysinfo from unexpected source addresses
Unexpected worker process crashes or restarts coinciding with inbound HTTP traffic to the affected service
Access violation events in Windows Event Log referencing the web server process and faulting address 0x0000000000000000

Detection Strategies

Correlate web access logs with process crash events to identify pattern-based triggering of the null dereference
Deploy intrusion detection signatures that flag HTTP requests targeting /status or /sysinfo paths against vulnerable installations
Monitor for repeated short-lived HTTP connections followed by service restarts on the affected host

Monitoring Recommendations

Forward web server access logs and Windows application crash logs to a centralized SIEM for correlation
Alert on consecutive crashes of the affected worker process within short time windows
Track baseline request volumes for /status and /sysinfo URI prefixes and alert on anomalies

How to Mitigate CVE-2026-8359

Immediate Actions Required

Restrict network access to the affected web server using firewall rules or reverse proxy access lists until a patch is applied
Block or filter inbound HTTP requests with URL paths beginning with /status or /sysinfo at an upstream proxy or web application firewall
Review the Tenable Security Research Advisory TRA-2026-45 for vendor-specific remediation guidance

Patch Information

No vendor patch URL is listed in the enriched CVE data at publication. Consult the Tenable Security Research Advisory TRA-2026-45 and the vendor's official channels for updated firmware or software releases addressing this issue.

Workarounds

Configure a reverse proxy or web application firewall to drop or return a static response for any request whose path matches /status* or /sysinfo*
Limit exposure of the web management interface to trusted management networks only
Implement process supervision to automatically restart the service after a crash, reducing downtime while a permanent fix is pending

bash

# Example NGINX reverse proxy rule to block vulnerable URL prefixes
location ~ ^/(status|sysinfo) {
    return 403;
}