# CVE-2022-26833: OAS Platform - Authentication Bypass

> Live exploitation tracking for CVE-2022-26833 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-26833

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.4
- **Public exploit available:** Yes
- **Affected products:** Open Automation Software OAS Platform
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** web_application

## Description

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.

## CrowdSec analysis

[CVE-2022-26833](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-26833) is an improper authentication vulnerability affecting the Open Automation Software OAS Platform, enabling attackers to bypass controls and gain unauthorized access to REST API functionality.

CrowdSec has been tracking this vulnerability and its exploits since 4th of April 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2022-26833 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2022-26833 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts commonly target URLs containing `/oasrest/v2/authenticate`.

## Timeline

- 2022-05-25: CVE Published. CVE-2022-26833 is published to NVD.
- 2025-04-04: Rule Released. CrowdSec releases a rule to detect CVE-2022-26833 exploitation attempts against the CrowdSec Network.
- 2025-04-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-26833 for the first time.

## References

- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1513
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26833.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-26833) follows observed exploitation activity for CVE-2022-26833. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.