CVE-2026-57469 | Nozomi Networks Labs

Summary

A CWE-352: Cross-Site Request Forgery in PiCtory at v2.16.0 allows remote attackers to perform actions through an authenticated operator's browser.

Impact

This issue allows a remote attacker to delete project files, reset the control runtime, and invoke other protected operations.

Issue Date

July 6, 2026

Affects

KUNBUS PiCtory v2.16.0

CVE Name

CVE-2026-57469

CVSS Details

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L

CVSS Score

5.1

Solution

To fix this issue, it is suggested to update to Pictory version 1.17.0

Mitigations

Acknowledgements

Gabriele Quagliarella at Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more

Nozomi Networks Threat Intelligence dashboard showing pie charts of targeted industries, countries, and malware types, with detailed threat actor and vulnerability information below.

Discover how easy it is to identify and respond to cyber threats by automating your OT and IoT asset discovery, inventory and management.

Request a Demo Watch Demo

Cross-Site Request Forgery (CSRF)

Summary

Impact

Issue Date

Affects

CVE Name

CVSS Details

CVSS Score

Solution

Mitigations

Acknowledgements

Nozomi Threat Intelligence

Latest Labs Blogs

Zero-Days at AI Speed: A Wake-Up Call for Critical Infrastructure

PLC Firmware Extraction Through Native Code Execution

Tengu: A Modernized Mirai That Doesn’t Want to Leave

Take the next step.

Subscribe

LinkedIn

Demo

PLATFORM

Professional Services

Solutions: Business needs

Solutions: Compliance

Solutions: Industry

Learn