CVE-2026-57898 -- CVSS 9.0 Vulnerability Briefing

CVE-2026-57898 | CVSS 9.0 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-57898 is an unauthenticated arbitrary file write vulnerability in the Eclipse BaSyx Java Server SDK, specifically affecting deployments that use the MongoDB backend and the Asset Administration Shell (AAS) thumbnail upload functionality.

Technical Detail

The flaw exists in Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 through 2.0.0-milestone-12, where the AAS thumbnail endpoint fails to enforce authentication or adequately validate file paths before writing attacker-supplied content to the server filesystem. An unauthenticated remote attacker can craft a request to the thumbnail upload interface and write arbitrary files to locations accessible by the server process. Depending on the deployment context and file system permissions, successful exploitation could lead to remote code execution by overwriting executable content, configuration files, or web-accessible scripts.

Exploitation Status

No known exploit code has been publicly identified at this time. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning there is no confirmed public proof-of-concept or observed in-the-wild activity as of July 21, 2026. However, the unauthenticated nature of the attack vector and the high CVSS score of 9.0 indicate low exploitation complexity, which increases the risk of rapid weaponization once the vulnerability receives broader attention.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability. Organizations operating BaSyx-based industrial or IIoT infrastructure should not treat the absence of attribution as an indicator of low risk given the severity of the flaw.

What To Do

Organizations running Eclipse BaSyx Java Server SDK with the MongoDB backend should prioritize upgrading to a version beyond 2.0.0-milestone-12 as soon as a patched release is available from the Eclipse BaSyx project. If an immediate upgrade is not feasible, restrict network access to the AAS thumbnail endpoint at the perimeter or application layer, ensuring that only authenticated and authorized clients can reach the affected interface. Deployments exposed to untrusted networks should be treated as high priority. Monitor server filesystem integrity and web-accessible directories for unexpected file creation events as a detection signal. Review server process permissions to limit the blast radius of any file write attempt by applying the principle of least privilege to the BaSyx service account.