The vulnerability is a missing authentication check on a critical REST API endpoint in Trex MES, allowing attackers to bypass authentication and execute privileged functions without credentials. This can lead to unauthorized modification or exfiltration of manufacturing data, tampering with control processes, and potential disruption of production. The weakness is identified as CWE-306, representing a security flaw where authentication is omitted.

The affected product is Trex MES from Trex Digital Smart Manufacturing Systems Inc. All released versions up to 2026-09-29 are impacted.

The CVSS score of 8.8 indicates high severity, and although no EPSS value is available the lack of enterprise-level mitigations suggests a realistic exploitation likelihood. The vulnerability is not listed in CISA KEV. The likely attack vector is remote, via the exposed REST API over the network, and could be exploited by unauthenticated users with network access to the MES system.