CVE-2026-34008
8.5HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-732
Impact
Local authenticated users can compromise the system's integrity, confidentiality, and availability. Attackers need a valid local user account on the target system to exploit this.
Root cause
Notes Station 3 incorrectly assigns permissions to a critical resource.
Affected systems
Notes Station 3 versions prior to 3.9.11
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Notes Station 3 to version 3.9.11 or later via the QTS App Center. If patching immediately is not possible, disable or stop the Notes Station 3 app.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later