Trex MES: Missing authentication in REST API allows authentication bypass

Summary

Trex MES, a manufacturing execution system, has a REST API endpoint that does not enforce server-side authentication for a critical function. An attacker with adjacent network access can bypass authentication without credentials or user interaction and may fully compromise confidentiality, integrity and availability of the system. The CVE record lists the affected range as all versions through 2026-09-29 and no fixed version is known.

Affected

• Trex MES through 2026-09-29 (date-based range; no version numbers published)

Fixed in

Unknown. No fixed version or vendor advisory has been found.

Workaround

• No vendor workaround documented.
• Restrict network access to the MES host through firewall rules, VPN or an allow-list.
• Keep the MES out of internet-facing and untrusted network segments.

Exploitation

• No known exploitation in the wild; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no.
• No public proof of concept found.

Our recommendation

• Check whether any Trex MES instance or REST endpoint is reachable from the internet, a partner network or a shared plant network.
• Isolate the MES strictly; treat instances with network reach beyond their own host as high priority.
• Confirm that all REST endpoints require authentication and review access logs for unexpected API calls.
• Ask Trex for a fixed build and advisory, and record the version each system runs.
• Assess CVE-2026-18782 (SQL injection in the same product, published the same day) together with this CVE.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Hasanuyarrr/CVE-2026-18783-TREX-MES-Uygulamalarinda-Yetkisiz-Nesne-Erisimi

Research sources

• TR-CERT national advisory (Siber Güvenlik Başkanlığı) siberguvenlik.gov.tr
• OpenCVE CVE-2026-18783 app.opencve.io
• HOL Guard CVE-2026-18783 hol.org
• ThreatInt CVE-2026-18783 cve.threatint.com
• The Hacker Wire CVE-2026-18783 www.thehackerwire.com
• Strix CVE-2026-18783 www.strix.ai
• OpenCVE CVE-2026-18782 (related SQL injection) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:07.