CVE-2026-4761

Unnecessary permissions on private keys of certificates installed by Network and Security Wizard

View on CVE.org
Published Mar 25, 2026 CVSS 4.0 · 3.3 Low EPSS < 1% KEV · Not listed
Description
When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group.
* Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed
* Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable


Please refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt.

Analysis

AI-generated

Technical impact

The vulnerability arises when the Network and Security tool installs certificates into the Windows machine certificate store, granting the Operator group read access to the corresponding private key. This unnecessary permission potentially allows any user who belongs to the Operator group to retrieve the private key, which could enable unauthorized cryptographic operations such as forging messages or establishing secure connections as the certificate owner.

Affected Systems

CODRA Panorama Suite version 25.00.004 (2025 release) running on Windows is impacted. Installations that have been updated to Panorama Suite 2025 Updated Dec. 25 (25.10.007) are no longer vulnerable.

Risk and Exploitability

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local access to a Windows system and membership in the Operator group, meaning the attack vector is likely local.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the CSIRT update PS-2500-00-0357 or a later version to all affected Panorama Suite 2025 installations.
  • Verify that private key permissions for installed certificates no longer include the Operator group.
  • If using the updated Panorama Suite 2025 (25.10.007), confirm that the installation is current and the bug is resolved.
  • Review the CSIRT security bulletin BS-036 for detailed guidance and any additional steps.

Generated by OpenCVE AI on April 2, 2026 at 05:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Codra panorama Collaborative Operation \& Execution
Codra panorama Com
Codra panorama E2
Codra panorama H2
CPEs cpe:2.3:a:codra:panorama_collaborative_operation_\&_execution:25.00.004:*:*:*:*:*:*:*
cpe:2.3:a:codra:panorama_com:25.00.004:*:*:*:*:*:*:*
cpe:2.3:a:codra:panorama_e2:25.00.004:*:*:*:*:*:*:*
cpe:2.3:a:codra:panorama_h2:25.00.004:*:*:*:*:*:*:*
Vendors & Products Codra panorama Collaborative Operation \& Execution
Codra panorama Com
Codra panorama E2
Codra panorama H2
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}
Type Values Removed Values Added
Description When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. * Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable Please refer to security bulletin BS-036, available on the Panorama CSIRT website:  https://my.codra.net/en-gb/csirt . When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. * Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable Please refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. * Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable Please refer to security bulletin BS-036, available on the Panorama CSIRT website:  https://my.codra.net/en-gb/csirt .
Title Unnecessary permissions on private keys of certificates installed by Network and Security Wizard
First Time appeared Codra
Codra panorama Suite
Weaknesses CWE-732
CPEs cpe:2.3:a:codra:panorama_suite:*:*:windows:*:*:*:*:*
cpe:2.3:a:codra:panorama_suite:panorama_suite_2025_updated_dec._25:*:windows:*:*:*:*:*
Vendors & Products Codra
Codra panorama Suite
References
Metrics cvssV4_0

{'score': 3.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Amber'}
Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource

Sources

Status
PUBLISHED
Assigner
CODRA
Published
Updated
Mar 26, 2026, 8:58 AM
Reserved
Mar 24, 2026, 9:12 AM

View source JSON

Updated
Mar 25, 2026, 1:06 PM

JSON

Status
Analyzed
Published
Mar 25, 2026, 1:16 PM
Modified
Jun 17, 2026, 10:57 AM

View source JSON

No data.

Updated
Apr 2, 2026, 7:59 AM

JSON