CISA warns of privilege escalation flaw in SALTO ProAccess Space
CISA issued an advisory on a SALTO ProAccess Space vulnerability that can let authenticated operators bypass partition controls on affected systems.
CISA said an authentication flaw in SALTO ProAccess Space before version 6.13 could let a logged-in operator reach spaces outside an assigned partition when tenancy is enabled.
CISA issued an advisory on July 16, 2026, for a vulnerability in SALTO ProAccess Space identified as CVE-2026-11889. The agency said the issue affects versions before 6.13 when the product’s tenancy or logical partition feature is enabled.
According to the advisory, the flaw could let an authenticated operator with valid credentials bypass authorization and access spaces outside a designated partition. CISA said installations without partitioning are not affected.
The advisory said the vulnerability is tied to CWE-639, or authorization bypass through a user-controlled key. CISA listed a CVSS v3.1 base score of 6.5, which it classified as medium, and a CVSS v4.0 base score of 7.1, which it classified as high.
CISA said the affected product is used in commercial facilities and critical manufacturing, with deployments listed as worldwide and the company headquarters in Spain. The agency credited Bernhard Lorenz of Limes Security with reporting the issue.
The advisory said no known public exploitation specifically targeting the vulnerability has been reported to CISA at the time of publication.
CISA recommended upgrading to version 6.13. It also advised organizations to minimize network exposure, keep control system devices off the public internet, place control system networks and remote devices behind firewalls, isolate them from business networks, use more secure remote access methods such as VPNs, and apply least-privilege principles for operator accounts.
Operators of affected systems would need to check whether they use tenancy or partitioning and whether their installations run a version earlier than 6.13. CISA’s advisory does not say the flaw has been exploited publicly, but it directs users to patch and reduce exposure.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()