Quick answers
- Is CVE-2026-18931 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18931 being exploited in the wild.
- How severe is CVE-2026-18931?
- Critical severity, with a CVSS score of 9.1, published 1 September 2026.
- Which products and versions are affected?
- TMT Machine Industry and Trade Ltd. Co Talassoft Industrial Management Software 4 to 15.
- Is there a fix for CVE-2026-18931?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-18931 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-18931?
- Check whether you run TMT Machine Industry and Trade Ltd. Co Talassoft Industrial Management Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a use of hard-coded credentials flaw in Talassoft Industrial Management Software versions 4 through 15. Attackers can extract embedded credentials from the software binaries or configuration files without authentication, allowing unauthorized access to sensitive systems and data. The attack requires local or direct access to the application but does not require user interaction or network traversal. An attacker can leverage these credentials to authenticate to backend systems, access databases, or gain administrative privileges over the industrial management infrastructure. Patches are available in version 16 and later.
Affected products
- TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software 4 to 15
Timeline
- 2026-09-01: disclosed