Cyber Resilience

CVE-2026-2844

Critical

Published: 28 February 2026

Published
28 February 2026
Modified
10 March 2026
KEV Added
Patch
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0025 16.1th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-2844 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Microchip Timepictra. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-5 (Access Restrictions for Change).

Deeper analysis

CVE-2026-2844 is a Missing Authentication for Critical Function vulnerability (CWE-306) in Microchip TimePictra, affecting versions from 11.0 through 11.3 SP2. The flaw enables Configuration/Environment Manipulation due to the lack of authentication for a critical function, as published on 2026-02-28.

With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), the vulnerability is exploitable by unauthenticated attackers over the network with low attack complexity and no user interaction required. Exploitation allows remote attackers to achieve high integrity impact by manipulating the TimePictra configuration or environment, potentially altering system settings without authorization.

Mitigation details are available in the Microchip advisory at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-authentication-bypass-vulnerability.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authentication on a critical function in a network-exposed management application (TimePictra) directly enables remote exploitation of a public-facing service for unauthorized configuration changes.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4810Shared CWE-306
CVE-2025-53847Shared CWE-306
CVE-2025-61757Shared CWE-306
CVE-2025-68715Shared CWE-306
CVE-2026-21992Shared CWE-306
CVE-2025-26362Shared CWE-306
CVE-2026-48692Shared CWE-306
CVE-2022-50981Shared CWE-306
CVE-2025-58083Shared CWE-306
CVE-2025-21515Shared CWE-306

Affected Assets

microchip
timepictra
11.3 · 11.0 — 11.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses missing authentication for critical functions by requiring identification, documentation, and restriction of unauthenticated access to prevent configuration manipulation.

prevent

Mandates identification and authentication for system services like the vulnerable TimePictra function, blocking unauthenticated remote attackers from manipulating configuration.

prevent

Restricts access to configuration changes to authorized roles or personnel, mitigating unauthorized environment manipulation in TimePictra.

References