Quick answers
- Is CVE-2026-40463 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40463 being exploited in the wild.
- How severe is CVE-2026-40463?
- High severity, with a CVSS score of 7.6, published 31 August 2026.
- Which products and versions are affected?
- Nokia WaveSuite.
- Is there a fix for CVE-2026-40463?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-40463 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-40463?
- Check whether you run Nokia WaveSuite. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control flaw in the CPB Log Files feature of WaveSuite. An authenticated low-privilege user can bypass role-based access controls by directly requesting URLs that should be restricted to higher-privilege roles, without additional authentication or checks. The vulnerability allows an attacker to enumerate and access log files and administrative pages not intended for their privilege level. This is a horizontal privilege escalation triggered purely by URL manipulation, requiring only valid (low-level) authentication and network access to the WaveSuite interface. Patch availability was not confirmed from the provided sources.
Affected products
- Nokia WaveSuite
Timeline
- 2026-08-31: disclosed