P4Verified

CVE-2026-111235: Meridian 2024.1.0 to before 2024.3.14, 2025.0.0 to before 2025.0.11, 2026.0.0 to before 2026.0.1; +1 more affected…

CVE-2026-111235. CVSS 3.1 base score 9.1 (CRITICAL, Vendor/CNA).

Affected technology

Meridian · 2024.1.0 to before 2024.3.14, 2025.0.0 to before 2025.0.11, 2026.0.0 to before 2026.0.1
The OpenNMS Group

Horizon · 36.0.0 to before 36.0.5
The OpenNMS Group

Description’s affected range: versions of OpenNMS Meridian and Horizon

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. Vendor/CNA’s CVSS 3.1 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.

Published 15-Oct-2026 20:21 UTC

CWE: CWE-204, CWE-862, CWE-863
CCR priority: 36.4 /100 (P4)
CVSS 3.1: 9.1 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · Vendor/CNA
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-15 20:17:11.213245+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-111235.html