Cyber Resilience

CVE-2026-24870

Low

Published: 27 January 2026

Published
27 January 2026
Modified
05 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0005 15.9th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24870 is a low-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Ixray-Team Ix-Ray Engine 1.6. Its CVSS base score is 3.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement).

Deeper analysis

CVE-2026-24870 is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability (CWE-200) in ixray-team's ixray-1.6-stcop software. The issue affects versions of ixray-1.6-stcop prior to 1.3. It carries a CVSS v3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting low overall severity due to high attack complexity despite network vector accessibility and low confidentiality impact.

An unauthenticated attacker with network access can exploit this vulnerability without requiring user interaction. Exploitation demands high complexity but enables the unauthorized actor to access limited sensitive information, with no effects on integrity or availability.

Mitigation is addressed in a patch via the GitHub pull request at https://github.com/ixray-team/ixray-1.6-stcop/pull/258. Affected users should upgrade to ixray-1.6-stcop version 1.3 or later to remediate the vulnerability.

EU & UK References

Vulnerability details

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

CWE(s)
CWE-200

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Network-accessible unauthenticated information disclosure vulnerability (CWE-200) in exposed software directly enables initial access via exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-24832Same product: Ixray-Team Ix-Ray Engine 1.6
CVE-2026-24831Same product: Ixray-Team Ix-Ray Engine 1.6
CVE-2024-13796Shared CWE-200
CVE-2025-25975Shared CWE-200
CVE-2024-12142Shared CWE-200
CVE-2025-25951Shared CWE-200
CVE-2026-34297Shared CWE-200
CVE-2024-26480Shared CWE-200
CVE-2026-24498Shared CWE-200
CVE-2025-22828Shared CWE-200

Affected Assets

ixray-team
ix-ray engine 1.6
≤ 1.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces access control policies to block unauthorized actors from retrieving sensitive information as described in the exposure vulnerability.

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow rules to stop unauthorized disclosure of sensitive data over the network before it occurs.

SC-8 Transmission Confidentiality and Integrity partial match
prevent

Protects confidentiality of data in transit, mitigating network-based exposure of sensitive information to unauthorized actors.

References