PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6411 Raw CVE debrief

CVE-2026-6411 affects MAXHUB Pivot client application versions prior to v1.36.2. According to the CISA advisory, the application may let an attacker recover encrypted tenant email addresses and related metadata from any tenant because a hardcoded AES key is present in the client. The same advisory also notes a denial-of-service risk if an attacker enrolls multiple unauthorized devices into a tenant via MQTT, which could disrupt tenant operations. MAXHUB states that v1.36.2 or newer is the fix.

Vendor
Raw
Product
MAXHUB MAXHUB Pivot client application <v1.36.2
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-07
Original CVE updated
2026-05-07
Advisory published
2026-05-07
Advisory updated
2026-05-07

Who should care

Organizations using MAXHUB Pivot client application versions prior to v1.36.2, especially tenant administrators and IT teams responsible for device enrollment, tenant access, and client updates.

Technical summary

The advisory describes two issues in MAXHUB Pivot client application prior to v1.36.2: first, tenant email addresses and related metadata are stored in encrypted form but can be decrypted because the application contains a hardcoded AES key; second, unauthorized device enrollment via MQTT may be abused to create a denial-of-service condition by enrolling multiple devices into a tenant. The source assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (7.3 High).

Defensive priority

High

Recommended defensive actions

  • Upgrade MAXHUB Pivot client application to v1.36.2 or later as soon as possible.
  • Inventory deployed Pivot client versions and confirm no affected versions remain in use.
  • Review tenant access and device enrollment activity for unexpected or unauthorized entries.
  • Restrict and monitor MQTT-related access paths used by the client and tenant enrollment workflow.
  • Assess whether tenant email addresses or related metadata may have been exposed before remediation.
  • Follow MAXHUB support guidance and keep the client on the latest available version.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-127-01 published on 2026-05-07 and the linked official references. The advisory text states that MAXHUB recommends upgrading to v1.36.2 or newer and notes that MAXHUB was not aware of public exploitation at the time of publication.

Official resources

Publicly disclosed by CISA in ICSA-26-127-01 on 2026-05-07; the advisory revision history lists the initial publication on the same date.