# CVE-2026-42933: Pronetiqs IntraVUE unintended proxy in OT segmentation bypass

Source: https://junglewise.ai/threats/cve-2026-42933-pronetiqs-intravue-unintended-proxy-in-ot-segmentation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-42933 · Severity: critical · CVSS 10 · Published 2026-07-23

Pronetiqs IntraVUE, a network management tool used to monitor industrial control systems, contains a critical security flaw. This vulnerability allows an attacker to use the software as an unauthorized bridge to reach protected industrial equipment. Exploiting this could allow an attacker to bypass network security boundaries and manipulate critical infrastructure devices, potentially leading to operational outages or safety risks.

## Quick answers

**Is CVE-2026-42933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42933 being exploited in the wild.

**How severe is CVE-2026-42933?** Critical severity, with a CVSS score of 10, published 23 July 2026.

**Which products and versions are affected?** Pronetiqs (Panduit) IntraVUE <= 3.2.1a14.

**Is there a fix for CVE-2026-42933?** A patch was published on 2026-07-23: Fix available in version 3.2.1a16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42933 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42933?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Pronetiqs IntraVUE (versions 3.2.1a14 and prior) is vulnerable to an unintended proxy or intermediary ('Confused Deputy') flaw, tracked as CWE-441. The vulnerability allows a remote, unauthenticated attacker to use the IntraVUE application as a proxy to forward malicious traffic into segmented Operational Technology (OT) networks. By exploiting this, an attacker can bypass network isolation and interact directly with industrial control devices without requiring specialized knowledge or physical access. This issue is resolved in version 3.2.1a16.

## Affected products

- Pronetiqs (Panduit) IntraVUE <= 3.2.1a14

## Timeline

- 2026-07-23: disclosed
- 2026-07-23: advisory: CISA Advisory ICSA-26-204-04 published
- 2026-07-23: patched: Fix available in version 3.2.1a16

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04](https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04)