CVE-2026-10056: CORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request

Synopsis

A CORS misconfiguration in the REST API of Network Optix Nx Witness VMS lets an unauthenticated remote attacker exfiltrate the session token of an authenticated user when that user visits a malicious cross-origin web page. The flaw is reachable over the network, requires no attacker credentials, and depends on the victim browsing to an attacker-controlled page; successful exploitation enables full Administrator account takeover with read, write, and disruption capabilities over the VMS. A patched-image rebuild at version 6.1.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the VMS REST API over the network from the victim's browser context.

• AuthenticationNot required

  No attacker credentials are needed; the exploit hijacks an existing authenticated session belonging to the victim.

• Victim interactionRequired

  An authenticated VMS user must visit a malicious cross-origin web page that issues the crafted request.

• Attack complexityDetail

  Complexity is high because the attacker must lure an already-authenticated administrator to a controlled page and time the cross-origin request against a live session.

Blast Radius

• Steals the session token of an authenticated VMS user, enabling Administrator account takeover.
• Reads camera feeds, recorded video, user accounts, and system configuration exposed through the REST API.
• Modifies VMS settings, user accounts, and stored configuration as an administrator.
• Disrupts video surveillance operations by disabling recording, removing users, or reconfiguring the system.