CVE-2026-4901

CVE-2026-4901 affects Hydrosystem Control System versions prior to 9.8.5 and involves the insecure logging of sensitive user credentials to an unprotected log file. This vulnerability becomes particularly critical when combined with CVE-2026-34184, which could allow an unauthorized user to access these exposed credentials and gain further authorized access to the system. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and valid user privileges but no user interaction. The primary impact is confidentiality compromise through unauthorized disclosure of authentication credentials, though integrity and availability are not directly affected by this vulnerability alone. Currently, CVE-2026-4901 shows no signs of active exploitation in the wild, with no publicly available exploit code reported and minimal community attention reflected in its low EPSS score of 0.00033. The vulnerability is not tracked on the Known Exploited Vulnerabilities catalog and remains inactive on the Hot List, suggesting limited near-term exploitation risk despite its credential exposure nature.