CVE-2026-4761

Unnecessary permissions on private keys of certificates installed by Network and Security Wizard

State: Published
Severity: 3.3 Low
Published: Mar 25, 2026
Updated: Mar 26, 2026
Reserved: Mar 24, 2026

Description

When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. * Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable

Please refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt.

Scores

CVSS	Score	Vector	Source
4.0	3.3 Low	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Amber	CODRA

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
Panorama SuiteCODRA	Panorama Suite 2025 to before update PS-2500-00-0357Affected Panorama Suite 2025 Updated Dec. 25Not affected

References

https://my.codra.net/api/csirt/download?resourceId=1469&fileType=FichierPDF

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.