PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6411 MAXHUB CVE debrief

CVE-2026-6411 affects MAXHUB Pivot client application versions prior to v1.36.2. According to the CISA advisory, the application may let an attacker recover encrypted tenant email addresses and related metadata from any tenant because a hardcoded AES key is present in the client. The same advisory also notes a denial-of-service risk if an attacker enrolls multiple unauthorized devices into a tenant via MQTT, which could disrupt tenant operations. MAXHUB states that v1.36.2 or newer is the fix.

Vendor
MAXHUB
Product
<v1.36.2
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-07
Original CVE updated
2026-05-07
Advisory published
2026-05-07
Advisory updated
2026-05-07

Who should care

Organizations using MAXHUB Pivot client application versions prior to v1.36.2, especially tenant administrators and IT teams responsible for device enrollment, tenant access, and client updates.

Technical summary

The advisory describes two issues in MAXHUB Pivot client application prior to v1.36.2: first, tenant email addresses and related metadata are stored in encrypted form but can be decrypted because the application contains a hardcoded AES key; second, unauthorized device enrollment via MQTT may be abused to create a denial-of-service condition by enrolling multiple devices into a tenant. The source assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (7.3 High).

Defensive priority

High

Recommended defensive actions

  • Upgrade MAXHUB Pivot client application to v1.36.2 or later as soon as possible.
  • Inventory deployed Pivot client versions and confirm no affected versions remain in use.
  • Review tenant access and device enrollment activity for unexpected or unauthorized entries.
  • Restrict and monitor MQTT-related access paths used by the client and tenant enrollment workflow.
  • Assess whether tenant email addresses or related metadata may have been exposed before remediation.
  • Follow MAXHUB support guidance and keep the client on the latest available version.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-127-01 published on 2026-05-07 and the linked official references. The advisory text states that MAXHUB recommends upgrading to v1.36.2 or newer and notes that MAXHUB was not aware of public exploitation at the time of publication.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6411 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6411

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6411 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6411

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-127-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-127-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.