External risk intelligence

Unauthenticated Web Server Information Leakage and File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-22096

The vulnerability affects a web server running on port 8090 that lacks authentication and permits file uploads and information leakage. Web services listening on custom ports are commonly exposed or reachable in many network environments, making this a likely target for external access if not properly restricted by perimeter controls.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a web server accessible via port 8090, which does not require authentication to access its features. This could allow unauthorized individuals to view sensitive configuration details, such as passwords, or to upload files to the server. The primary concern is to confirm if this specific web server component is present and exposed within our environment.

Unauthenticated access to a web server.
Confirms exposure of sensitive data and file upload.
Verify if this specific web server is in use.

Attack Path

How an attacker could exploit the issue

An attacker can target a web server accessible over the network that listens on port 8090. This server, lacking authentication, allows attackers to potentially access sensitive information, such as configured passwords, or upload files via various endpoints.

No authentication required for access.
Sensitive information leakage and file uploads.
Leaked credentials and unauthorized file uploads.

Live Threat

Current exploitation, exposure, and threat context

The web server, when accessible externally, could expose configured passwords and allow unauthorized file uploads through its endpoints. This could impact system security and data integrity.

Sensitive configuration data.
Unauthorized file uploads.
System compromise or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects an unauthenticated web server on port 8090, allowing for sensitive information disclosure and file uploads. Responsibility likely falls to the platform or infrastructure teams managing the server, in coordination with application owners who utilize the service. The first step is to identify all instances of this web server, assess their external reachability and business criticality, and determine the accountable owner before planning remediation.

Identify affected web server instances.
Verify external reachability and impact.
Plan remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the web server component involved in CVE-2026-22096?

This CVE concerns a lightweight web server typically used for backend administrative tasks or service management. It operates on network port 8090. Because it is often bundled with specific infrastructure tools or application platforms to provide local management interfaces, it is frequently overlooked in standard web security reviews, making it a critical area to verify within your environment.

What is the weakness class for this CVE?

This vulnerability is classified as CWE-306, which refers to Missing Authentication for Critical Function. In plain terms, the software fails to verify who is attempting to access its endpoints. Because it lacks this fundamental identity check, the system treats all incoming requests as trusted, granting anyone with network access the ability to retrieve sensitive data or push new files onto the server.

How does an attacker trigger CVE-2026-22096?

An attacker triggers this by simply sending standard HTTP requests to the target server on port 8090. No complex exploits or prior credentials are required because the software is designed without a login mechanism. Note that simply having the port open does not imply exploitation, but the bug is triggered the moment an unauthorized request is successfully processed by the server's endpoints.

Why is this considered a high-risk issue?

According to Halo Surface Signal, this is categorized as highly likely to be a target because services on custom ports like 8090 are frequently exposed to the wider network or internet. If your server is reachable from outside your secure perimeter, unauthorized individuals can remotely extract passwords or inject malicious files, potentially leading to full control over the affected system.

Do I need to take action if I use this software?

Yes, you should prioritize identifying where this server is running in your network. Your first step is to confirm the presence of the service and determine if it is reachable from untrusted network segments. Once located, coordinate with the infrastructure or application team responsible for that specific instance to restrict network access or disable the service until a formal update or configuration change can be applied.

References

csirt.divd.nl/DIVD-2026-00001/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.