CVE-2026-34184

CVE-2026-34184 is a critical authorization bypass vulnerability affecting Hydrosystem Control System versions prior to 9.8.5. The flaw allows unauthenticated remote attackers to read arbitrary files from unprotected directories and execute PHP scripts directly against connected databases, creating a severe exposure of sensitive data and system compromise. The vulnerability carries a CVSS score of 9.1 (Critical) with a network-based attack vector requiring no authentication, user interaction, or special conditions. The attack is straightforward to execute with low complexity, resulting in high impact to confidentiality and integrity of affected systems. The EPSS score of 0.00041 indicates this is not among the most frequently targeted vulnerabilities, though the critical CVSS rating warrants immediate patching. Current exploitation status indicates no active in-the-wild activity, with the vulnerability absent from the Known Exploited Vulnerabilities (KEV) catalog and marked as inactive on threat intelligence lists. No publicly disclosed exploit code or significant community attention has been documented. However, the simplicity of exploitation and critical severity mean this should be treated as a high priority for remediation given the potential for rapid exploitation once awareness increases.