PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-94410 Bender CVE debrief

A low-privileged remote attacker can view a list of roles meant for administrators in Bender's Custom&Partner Service, leading to a low-level confidentiality breach. No particularly sensitive information is exposed. The issue has a CVSS score of 5.3 and is classified as MEDIUM severity. This vulnerability allows attackers to gain visibility into role lists, potentially aiding in further attacks. Defenders should verify exposure, assess impact, and take necessary actions to mitigate the vulnerability, including reviewing access controls and ensuring role visibility is restricted to authorized personnel only.

Vendor
Bender
Product
Customer&Partner
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-13
Advisory published
2026-10-13
Advisory updated
2026-10-13

Who should care

Defenders and administrators responsible for Bender's Custom&Partner Service should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-94410 is a MEDIUM-severity vulnerability in Bender's Custom&Partner Service that allows low-privileged remote attackers to view role lists meant for administrators. Defenders should verify exposure, assess impact, and take necessary actions to mitigate the vulnerability.

  • Defenders need to verify if their systems are affected and update to version 5.17.5 or higher to patch the vulnerability.
  • Low-privileged remote users may gain visibility into role lists, potentially aiding in further attacks.
  • Defenders should review access controls and ensure that role visibility is restricted to authorized personnel only.
  • Monitoring for unauthorized access attempts to the Custom&Partner Service is crucial.

Technical summary

The CVE-2026-94410 vulnerability allows low-privileged remote attackers to view a list of roles intended for administrators in Bender's Custom&Partner Service. This results in a low-level confidentiality breach. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Affected versions are prior to 5.17.5.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they use Bender's Custom&Partner Service.

Recommended defensive actions

  • Verify if the Custom&Partner Service is in use and assess the potential impact of role list exposure.
  • Check if the service version is 5.17.5 or higher to determine if the vulnerability is patched.
  • Review and update access controls to limit role visibility to authorized personnel only.
  • Monitor for any unauthorized access attempts to the Custom&Partner Service.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its CVSS score and affected versions. However, the corpus does not establish specific exploitation instances or remediation steps beyond version updates.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-94410 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-94410

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-94410 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-94410

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.