Is CVE-2026-75162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75162 being exploited in the wild.

How severe is CVE-2026-75162?

Medium severity, with a CVSS score of 6.5, published 4 September 2026.

Is there a fix for CVE-2026-75162?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75162 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-75162?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75162: MBS X-Serie Gateway OPC-UA credential disclosure

CVE-2026-75162 · Severity: medium · CVSS 6.5 · Published 2026-09-04

The MBS X-Serie Gateway is a universal industrial gateway used to bridge building automation protocols like KNX, PROFIBUS, and OPC-UA. A vulnerability in the gateway's web configuration interface allows any authenticated user—even those with basic Standard role permissions—to retrieve OPC-UA authentication credentials in plaintext. An attacker with valid (low-privilege) credentials could extract sensitive authentication tokens and use them to compromise OPC-UA systems connected to the gateway.

Quick answers

Is CVE-2026-75162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75162 being exploited in the wild.
How severe is CVE-2026-75162?: Medium severity, with a CVSS score of 6.5, published 4 September 2026.
Which products and versions are affected?: MBS X-Serie Gateway V6_00_05.
Is there a fix for CVE-2026-75162?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75162 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-75162?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS X-Serie Gateway firmware V6_00_05. A remote authenticated user with Standard role privileges can query the JSON API endpoint to retrieve OPC-UA authentication credentials in cleartext, exposing sensitive authentication material. The vulnerability requires valid authentication credentials to access the vulnerable endpoint, but the low-privileged Standard role is sufficient to exploit it. An attacker with valid user credentials could extract OPC-UA authentication secrets and pivot to compromise downstream building automation systems. Patch availability and fix details are not specified in the advisory.

Affected products

MBS X-Serie Gateway V6_00_05

Timeline

2026-09-04: disclosed
2026-09-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.