CVE-2026-28698: Pronetiqs IntraVUE Information Exposure in Host Filesystem

CVE-2026-28698 · Severity: high · CVSS 8.6 · Published 2026-07-23

Pronetiqs IntraVUE, a network management tool used to monitor industrial control systems, contains a vulnerability that allows unauthorized access to sensitive system information. An attacker could exploit this to view files on the underlying host server or shared network drives. This exposure could lead to the theft of configuration data or other sensitive business information, potentially aiding further attacks against the industrial network.

Technologies: Pronetiqs IntraVUE. Vendors: Pronetiqs.

Quick answers

Is CVE-2026-28698 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28698 being exploited in the wild.
How severe is CVE-2026-28698?
High severity, with a CVSS score of 8.6, published 23 July 2026.
Which products and versions are affected?
Pronetiqs IntraVUE <= 3.2.1a14.
Is there a fix for CVE-2026-28698?
A patch was published on 2026-07-23: Version 3.2.1a16 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28698 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28698?
Check whether you run Pronetiqs IntraVUE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Pronetiqs IntraVUE versions 3.2.1a14 and prior are affected by CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The vulnerability allows a remote, unauthenticated attacker to access sensitive system information, specifically exposing the underlying host or shared filesystem. This occurs because the application does not properly restrict access to system-level data from unauthorized control spheres. Successful exploitation grants the attacker high confidentiality impact by allowing them to read files they should not have access to. The vendor has released version 3.2.1a16 to address this issue.

Affected products

  • Pronetiqs IntraVUE <= 3.2.1a14

Timeline

  • 2026-07-23: disclosed
  • 2026-07-23: advisory: ICSA-26-204-04 published by CISA
  • 2026-07-23: patched: Version 3.2.1a16 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.