Is CVE-2026-21404 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21404 being exploited in the wild.

How severe is CVE-2026-21404?

Medium severity, with a CVSS score of 6.3, published 4 June 2026.

Which products and versions are affected?

NAVTOR NavBox through 4.16.1.20.

Is there a fix for CVE-2026-21404?

A patch was published on 2026-04: NAVTOR released version 4.17.2.6 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21404 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-21404?

Check whether you run NAVTOR NavBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21404: NAVTOR NavBox hard-coded credentials in SOAP implementation

CVE-2026-21404 · Severity: medium · CVSS 6.3 · Published 2026-06-04

NAVTOR NavBox, a maritime navigational data distribution system, contains a security flaw where login credentials are permanently embedded in its communication software. A person with local access to the system could discover these credentials and use them to bypass security controls. This could allow an unauthorized user to modify or delete critical application files, potentially disrupting maritime operations or navigational data integrity.

Technologies: NAVTOR NavBox. Vendors: NAVTOR.

Quick answers

Is CVE-2026-21404 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21404 being exploited in the wild.
How severe is CVE-2026-21404?: Medium severity, with a CVSS score of 6.3, published 4 June 2026.
Which products and versions are affected?: NAVTOR NavBox through 4.16.1.20.
Is there a fix for CVE-2026-21404?: A patch was published on 2026-04: NAVTOR released version 4.17.2.6 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21404 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-21404?: Check whether you run NAVTOR NavBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability (CWE-798) exists in the Windows Communication Foundation (WCF) SOAP implementation of NAVTOR NavBox. Hard-coded credentials within the SOAP functionality can be extracted by a local attacker with low privileges. Once extracted, these credentials allow the attacker to authenticate against the SOAP interface and access privileged WCF methods. This access enables the attacker to perform file write or overwrite operations within application-defined paths. The attack complexity is considered high because it requires local access and specific conditions for the SOAP functionality to be enabled. A patch was released in April 2026 (version 4.17.2.6) which is automatically deployed to connected devices.

Affected products

NAVTOR NavBox through 4.16.1.20

Timeline

2026-04: patched: NAVTOR released version 4.17.2.6 to address the issue.
2026-06-04: disclosed: Initial publication of ICSA-26-155-01.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.