CVE-2026-121022

HIGH 8.1

Default Administrator Password Change Not Enforced in Axxon One Web Client

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

CWE	CWE-1393
Vendor	axxonsoft
Product	axxon one
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for axxonsoft axxon one

Be the first to know when new high vulnerabilities affecting axxonsoft axxon one are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

AxxonSoft / Axxon One

0 < 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

axxonsoft.com: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022

Credits

Discovered internally by the AxxonSoft QA team.