CVE-2026-36035 - Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the license from the webserver

Back Back to CVE browser

MEDIUM

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the license from the webserver

Published Jul 14, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.52%

Description

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the license from the webserver.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (4)

Link	Providers	Tags
https://caxperts.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44578		Advisory
https://medium.com/@hacker.dan/hello-world-first-post-first-cve-6671b82e2b71
https://universalplantviewer.com