CVE-2026-22908 CRITICAL

CVE-2026-22908

Vendor Sick Ag

Product TDC-X401GL

Weakness CWE-266

Published January 15, 2026

Last update January 15, 2026

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.

Key dates

02Disclosure timeline

January 15, 2026 CVE published

January 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-22908 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/266.html

Related vulnerabilities

04Related CVE

CVE-2025-48142 WordPress Bookify <= 1.0.9 - Privilege Escalation Vulnerability CVE-2021-1594 Cisco Identity Services Engine Privilege Escalation Vulnerability CVE-2025-13888 Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs CVE-2025-57797 CVE-2025-15656 WordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerability