CVE-2026-39997
8.9HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Remote attackers on the adjacent network can compromise and gain access to the system without credentials, though it requires user interaction. They need local network access and a user to trigger an action.
Root cause
Critical functions in HybridDesk Station lack proper authentication checks.
Affected systems
HybridDesk Station versions prior to 4.2.22.
CVSS v4.0 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade HybridDesk Station to version 4.2.22 or later via QTS App Center. If you cannot patch immediately, disable or stop HybridDesk Station in App Center.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later