Quick answers
- Is CVE-2026-12620 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12620 being exploited in the wild.
- How severe is CVE-2026-12620?
- Informational severity, with a CVSS score of 4.6, published 19 June 2026.
- Which products and versions are affected?
- Microchip Technology GridTime 3000 GNSS Time Server 1.0r0.03 through 1.1r0.0.
- Is there a fix for CVE-2026-12620?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-12620 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-12620?
- Check whether you run Microchip Technology GridTime 3000 GNSS Time Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The GridTime 3000 GNSS Time Server is vulnerable to information exposure (CWE-200) because it transmits session access tokens as plaintext URL parameters rather than using secure headers or request bodies. An attacker with access to network traffic logs, proxy server logs, or browser history could intercept these tokens. While the CVSS score suggests high privileges are required for the initial session, the exposure of the token allows for session hijacking or subsequent unauthorized actions. The vulnerability exists in versions 1.0r0.03 through 1.1r0.0.
Affected products
- Microchip Technology GridTime 3000 GNSS Time Server 1.0r0.03 through 1.1r0.0
Timeline
- 2026-06-19: disclosed: Initial advisory publication by Microchip Technology