Is CVE-2026-90509 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90509 being exploited in the wild.

How severe is CVE-2026-90509?

High severity, with a CVSS score of 7.3, published 13 September 2026.

Which products and versions are affected?

Dromara Orion-Visor up to 2.5.7.

Is there a fix for CVE-2026-90509?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90509 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-90509?

Check whether you run Dromara Orion-Visor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90509: dromara orion-visor hardcoded credential authentication bypass

CVE-2026-90509 · Severity: high · CVSS 7.3 · Published 2026-09-13

Orion-visor is a lightweight bastion host and operations automation platform for managing servers via SSH, RDP, VNC and other protocols. The product contains hardcoded default authentication tokens in its source code that allow remote attackers to bypass authentication and access sensitive agent-facing APIs, potentially gaining unauthorized control over monitored servers and their management functions.

Vendors: Dromara.

Quick answers

Is CVE-2026-90509 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90509 being exploited in the wild.
How severe is CVE-2026-90509?: High severity, with a CVSS score of 7.3, published 13 September 2026.
Which products and versions are affected?: Dromara Orion-Visor up to 2.5.7.
Is there a fix for CVE-2026-90509?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90509 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-90509?: Check whether you run Dromara Orion-Visor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A hardcoded credential vulnerability exists in the ExposeApiAspect.beforeExposeApi() function in orion-visor up to version 2.5.7. The application uses a custom authentication mechanism via @ExposeApi annotations for internal agent-facing APIs; however, when the API_EXPOSE_TOKEN environment variable is not set, the system falls back to a hardcoded default token (pmqeHOyZaumHm0Wt) visible in the public source code. An unauthenticated remote attacker can supply this token in the request header to bypass authentication and access multiple critical endpoints, including those for agent state management (setAgentOnline, setAgentOffline, setAgentHeartbeat) and host monitoring (addMetrics, syncHostMeta). No patch has been released as of the advisory date, and the project has not yet responded to the early disclosure.

Affected products

dromara orion-visor up to 2.5.7

Timeline

2026-07-31: disclosed: Vulnerability reported via GitHub issue #170
2026-09-13: advisory: CVE-2026-90509 published
2026-09-13: other: Public exploit available; no vendor response to early disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.