Is CVE-2026-28806 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28806 being exploited in the wild.

How severe is CVE-2026-28806?

High severity, with a CVSS score of 8.8, published 10 March 2026.

Is there a fix for CVE-2026-28806?

A patch was published on 2026-03-10: Fixed in version 2.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28806 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-28806?

Check whether you run Nerves-Hub Nerveshub or NervesHubWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28806: NervesHub nerves_hub_web Improper Authorization in Device API

CVE-2026-28806 · Severity: high · CVSS 8.8 · Published 2026-03-10

NervesHub is a management platform for managing firmware updates and remote access for connected hardware devices. A security flaw in the platform's web interface allows an authorized user from one organization to gain control over devices belonging to a completely different organization. An attacker could use this to disrupt device connectivity, interfere with firmware updates, or potentially gain full remote console access to sensitive hardware.

Vendors: NervesHub.

Quick answers

Is CVE-2026-28806 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28806 being exploited in the wild.
How severe is CVE-2026-28806?: High severity, with a CVSS score of 8.8, published 10 March 2026.
Which products and versions are affected?: NervesHubWeb 1.0.0 to 2.3.9.
Is there a fix for CVE-2026-28806?: A patch was published on 2026-03-10: Fixed in version 2.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28806 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-28806?: Check whether you run Nerves-Hub Nerveshub or NervesHubWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability exists in the device bulk actions and device update API endpoints of nerves_hub_web. The root cause is a failure to properly scope device lookups and authorization checks to the authenticated user's organization. An attacker with low-privileged credentials can manipulate device identifiers in API requests to target devices outside their own organization. Successful exploitation allows an attacker to move devices to products they control, disrupt firmware updates, or, if remote console features are enabled, achieve full compromise of the affected hardware. The issue is fixed in version 2.4.0.

Affected products

nerves-hub nerves_hub_web 1.0.0 to 2.3.9

Timeline

2026-03-10: disclosed
2026-03-10: patched: Fixed in version 2.4.0
2026-03-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.