CVE-2026-2844
Published: 28 February 2026
Summary
CVE-2026-2844 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Microchip Timepictra. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-5 (Access Restrictions for Change).
Deeper analysis
CVE-2026-2844 is a Missing Authentication for Critical Function vulnerability (CWE-306) in Microchip TimePictra, affecting versions from 11.0 through 11.3 SP2. The flaw enables Configuration/Environment Manipulation due to the lack of authentication for a critical function, as published on 2026-02-28.
With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), the vulnerability is exploitable by unauthenticated attackers over the network with low attack complexity and no user interaction required. Exploitation allows remote attackers to achieve high integrity impact by manipulating the TimePictra configuration or environment, potentially altering system settings without authorization.
Mitigation details are available in the Microchip advisory at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-authentication-bypass-vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9101
Vulnerability details
Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on a critical function in a network-exposed management application (TimePictra) directly enables remote exploitation of a public-facing service for unauthorized configuration changes.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses missing authentication for critical functions by requiring identification, documentation, and restriction of unauthenticated access to prevent configuration manipulation.
Mandates identification and authentication for system services like the vulnerable TimePictra function, blocking unauthenticated remote attackers from manipulating configuration.
Restricts access to configuration changes to authorized roles or personnel, mitigating unauthorized environment manipulation in TimePictra.