---
id: CVE-2026-121024
title: Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
summary: >-
  Incorrect Authorization (CWE-863) in the Health Monitoring service in
  AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in
  possession of a shared report token, which is intended for read-only access,
  to create, modify or…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-863
vendor: AxxonSoft
product: AxxonNet
affected:
  - AxxonNet < 3.28.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T20:18:02.836202Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:18:16.710Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121024'
references:
  - url: >-
      https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121024
tags:
  - cve.org
epss: 0.00207
epssPercentile: 0.1082
ingestedAt: '2026-11-05T20:33:06.441Z'
---

## Overview

Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.

## Affected

- `AxxonNet < 3.28.0`

## Remediation

Upgrade AxxonNet to version 3.28.0 or later. Revoke and reissue shared report tokens that were distributed before the upgrade, and review the monitoring alert configuration for unauthorized changes.