CVE-2026-4619

Medium

Published: 27 March 2026

Published

27 March 2026

Modified

20 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0031 23.0th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-4619 is a medium-severity Path Traversal (CWE-22) vulnerability in Nec Aterm Wx3600Hp Firmware. Its CVSS base score is 6.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-4619 is a Path Traversal vulnerability (CWE-22) in NEC Platforms, Ltd. Aterm Series products. Published on 2026-03-27, it enables an attacker to write over any file via the network. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high impacts across confidentiality, integrity, and availability.

A remote network attacker requires no privileges, authentication, or user interaction to exploit this issue with low attack complexity. Successful exploitation allows arbitrary file overwrites, which could enable full device compromise, such as altering configurations, injecting malware, or disrupting operations.

NEC Platforms has issued security advisory nv26-001, available at https://jpn.nec.com/security-info/secinfo/nv26-001_en.html, addressing this vulnerability. Security practitioners should consult the advisory for specific mitigation steps and patch availability.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-16586

Vulnerability details

Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated remote path traversal enabling arbitrary file overwrite on a network-accessible device directly maps to exploitation of a public-facing application for initial access and full compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0