CVE-2026-4761 Details
Description
When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. * Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable Please refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt.
A vulnerability exists in Panorama Suite 2025 installations prior to update PS-2500-00-0357, where certificates and their private keys installed via the Network and Security tool are granted unnecessary access rights to the operator group. This issue does not affect installations on Panorama Suite 2025 Updated Dec. 25.
Users can update to Panorama Suite 2025 (Updated Dec. 25) or version PS-2500-00-0357 or later. For certificates installed with earlier versions, the private key permissions must be manually corrected by removing the Operators group access. This can be done through the computer certificate management console.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://my.codra.net/api/csirt/download?resourceId=1469&fileType=FichierPDF | CODRA | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CODRA |
Affected Products
| Product | Versions |
|---|---|
| codra panorama collaborative operation & execution | 25.00.004 |
CPE
Remediation
| |
| codra panorama com | 25.00.004 |
CPE
Remediation
| |
| codra panorama e2 | 25.00.004 |
CPE
Remediation
| |
| codra panorama h2 | 25.00.004 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CODRA |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | CVE Modified | CODRA |
| Mar 25, 2026 | New CVE Received | CODRA |