CVE-2026-33591 · WAPT Server Authentication Bypass via Alternate Path (Session Token…

01 · The Real Story

Someone left the master key to your software warehouse under the doormat, and any passerby can pick it up

CVE-2026-33591 is an authentication bypass (CWE-288) in Tranquil IT's WAPT Server, an enterprise software deployment and patch management platform. By sending a specially crafted network packet, a remote unauthenticated attacker can retrieve a valid session token for any targeted account — including the admin console. Affected versions span 2.6.0.16767 through 2.6.1.17787; the fix lands in 2.6.1.17813. Both WAPT Enterprise and Community editions are vulnerable.

The CNA (ENISA) scored this CVSS 4.0 10.0, and for once the top-of-scale rating is directionally correct — though CVSS 4.0 10s are mechanically common for unauthenticated remote bugs, the blast radius here genuinely justifies alarm. WAPT Server's *entire purpose* is pushing software packages to managed endpoints. An attacker who steals an admin session token does not just read data — they gain the ability to push arbitrary payloads fleet-wide, turning a single auth bypass into a supply-chain-grade compromise vector. The narrow installed base (primarily French and francophone enterprises) is the only real friction, and it doesn't change the severity for organizations that actually run WAPT.

"Unauthenticated auth bypass on a fleet deployment server is a skeleton key to every managed host."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Identify WAPT Server on the network

The attacker scans for WAPT Server's default HTTPS listener (typically port 443 or 8443). WAPT Server exposes well-known API endpoints (e.g., /api/v3/) that fingerprint easily. In most deployments the server is internal-only, but agents across the LAN must reach it, so it's broadly reachable from any compromised workstation or VPN-connected device.

Conditions required:

Network access to WAPT Server port (internal LAN, VPN, or — rarely — internet-exposed)

Where this breaks in practice:

WAPT Server is almost never internet-facing; attacker typically needs internal network position first

Detection/coverage: Network scanners (Nessus plugin pending, Qualys QID pending) should detect WAPT version via banner. GreyNoise/Shodan show negligible internet exposure for WAPT.

STEP 02

Send crafted packet to steal session token

The attacker sends a specially crafted request that exploits the CWE-288 alternate-path authentication flaw. The server returns a valid session token for the targeted account without requiring credentials. The attack requires no user interaction and no prior authentication — it is a single-request exploit with low complexity.

Conditions required:

HTTP(S) connectivity to WAPT Server
Knowledge of a valid username (admin accounts often have predictable names like admin or match AD principals)

Where this breaks in practice:

No public PoC exists yet (disclosed 2026-08-03), raising the bar for commodity attackers
Exact packet structure is undisclosed; reverse-engineering the patch diff is required

Detection/coverage: WAF rules could catch anomalous auth-path requests once signatures are published. WAPT Server access logs should show session-grant events without preceding credential exchange.

STEP 03

Authenticate as admin to WAPT console

With the stolen session token, the attacker accesses the WAPT management console with full administrative privileges. This grants control over package repositories, host groups, deployment rules, and agent configurations across the entire managed fleet.

Conditions required:

Valid session token from Step 2

Where this breaks in practice:

None — the token is fully valid and indistinguishable from a legitimate session

Detection/coverage: Anomalous admin login from unexpected source IPs. Session creation without corresponding authentication event in upstream IdP logs.

STEP 04

Push malicious package to managed endpoints

The attacker creates or modifies a WAPT package containing a malicious payload (reverse shell, ransomware loader, credential harvester) and assigns it to target host groups. WAPT agents on managed endpoints pull and execute the package with SYSTEM-level privileges during their next update cycle. This is the supply-chain detonation point.

Conditions required:

Admin-level WAPT console access (achieved in Step 3)
Managed endpoints configured to trust packages from this WAPT Server (default behavior)

Where this breaks in practice:

Package signing may require the server's private key — but an admin session likely grants access to the signing mechanism
Organizations using external code-signing HSMs would block unsigned packages

Detection/coverage: Endpoint EDR should flag unexpected child processes from the WAPT agent service. Package integrity monitoring (if implemented) would detect unauthorized package modifications.

03 · Compensating Control

Restrict WAPT Server network access to management VLAN only — Immediately firewall the WAPT Server so only authorized admin workstations and WAPT agents can reach its HTTPS port. This eliminates the attack from general internal network positions. Deploy within 3 days per noisgate mitigation SLA for CRITICAL findings.

Monitor WAPT Server access logs for session anomalies — Alert on session-grant events that lack a corresponding authentication event or originate from unexpected source IPs. This detects exploitation attempts. Deploy within 3 days.

Audit WAPT package integrity — Review all packages currently staged in the WAPT repository for unauthorized modifications. Compare hashes against known-good baselines. If external code-signing is available, enforce signature validation on agents.

Apply patch to version 2.6.1.17813 — This is the definitive remediation. The patch has been available since June 2026. Apply within the noisgate remediation SLA of 90 days for CRITICAL, but given the trivial exploitability, treat this as urgent — patch within days, not weeks.

What doesn't work

WAF in front of WAPT Server — Most WAPT deployments are internal and do not sit behind a WAF. Even if one is deployed, there are no published signatures for the crafted packet yet, so generic WAF rules are unlikely to catch the bypass.
MFA on WAPT console login — The vulnerability bypasses the authentication mechanism entirely to steal a session token. MFA protects the normal login flow, not the alternate path exploited here.
EDR on the WAPT Server host — EDR will not detect a valid-looking authenticated session. The exploit is a logic flaw, not a binary exploit — there is no shellcode, no memory corruption, nothing for behavioral detection to flag on the server side. EDR on *endpoints* may catch malicious packages after the fact, but that's post-detonation.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	No known exploitation. Not listed on CISA KEV. No reports from threat intelligence feeds as of 2026-08-04. Vulnerability is <48 hours old.
Proof-of-Concept	No public PoC available. Patch diff not yet publicly analyzed. Discovered by Brian Chervy (System Engineer, Antiane). Exploit complexity appears low once the alternate auth path is identified.
EPSS Score	Not yet scored — CVE published 2026-08-03, EPSS model has not yet ingested. Expect a moderate-to-high initial score given unauthenticated remote + low complexity.
KEV Status	Not listed. No CISA KEV entry as of 2026-08-04.
CVSS Vector	CVSS 4.0: 10.0 CRITICAL (CNA/ENISA) — `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`. NVD has not published a CVSS 3.1 vector. The 4.0 vector reflects network-accessible, low-complexity, no-auth, full-impact across confidentiality/integrity/availability with downstream scope.
Affected Versions	WAPT Server (Enterprise & Community) versions 2.6.0.16767 through 2.6.1.17787
Fixed Version	2.6.1.17813 — vendor advisory published 2026-06-09, CVE published 2026-08-03
Scanning / Exposure	Shodan/Censys show negligible internet-facing WAPT Server instances. WAPT is a niche product primarily deployed in French/francophone enterprise and public-sector environments. Typical deployment is internal LAN only.
Disclosure Timeline	Vendor advisory: 2026-06-09. CVE publication: 2026-08-03. Patch available since June — there is a ~2-month window where unpatched orgs have been exposed.
Reporter	Brian Chervy, System Engineer at Antiane (Réunion). Responsible disclosure to Tranquil IT.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.2/10)

Why this verdict

Unauthenticated remote, zero-interaction attack: The auth bypass requires no credentials, no user interaction, and low attack complexity — a single crafted packet yields a valid admin session token. This is the most dangerous attack surface profile possible.
Role multiplier — canonical fleet deployment server: WAPT Server exists solely to push software packages to managed endpoints. 100% of installations are in this high-value role. Admin access → push arbitrary packages → SYSTEM-level code execution on every managed host. The blast radius is fleet-scale by design, meeting the CRITICAL floor rule.
Patch has been available for ~2 months but CVE just published: The vendor advisory went out 2026-06-09 but the CVE was only published 2026-08-03. Organizations relying on CVE feeds for prioritization have been flying blind — unpatched instances have had extended exposure.
Low friction once network access is achieved: No complex exploit chain, no race conditions, no memory corruption — this is a logic bug in the authentication path. Reliability is expected to be near-100% once the packet structure is understood.

Why not higher?

This is already assessed at CRITICAL (9.2). The 0.8-point deduction from a theoretical 10.0 reflects the absence of confirmed in-the-wild exploitation, no public PoC, and the product's niche installed base which limits the total population at risk. If a PoC drops or KEV listing occurs, the score would move toward 9.8.

Why not lower?

Downgrading below CRITICAL is blocked by the deployment-role floor rule. WAPT Server is *by definition* a fleet management platform — every installation is a high-value supply-chain node. The unauthenticated remote auth bypass converts to fleet-wide code execution in four trivial steps. Internal-network-only exposure is typical for management servers and does not reduce severity for the organizations that run them; it merely reduces the *internet-reachable* attack surface, which is a population filter, not a severity filter.

06 · Verification

Crowdsourced verification payload.

Run this script on the WAPT Server host (Linux) as any user with read access to the WAPT configuration. Invoke with: bash check_cve_2026_33591.sh. No elevated privileges required — it only reads the installed package version.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_33591.sh
# Checks whether the installed WAPT Server version is vulnerable to CVE-2026-33591
# Affected: 2.6.0.16767 through 2.6.1.17787
# Fixed:    2.6.1.17813+
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

# Try to get WAPT version from dpkg (Debian/Ubuntu) or rpm (RHEL/CentOS)
VERSION=""
if command -v dpkg-query &>/dev/null; then
  VERSION=$(dpkg-query -W -f='${Version}' tis-waptserver 2>/dev/null || true)
elif command -v rpm &>/dev/null; then
  VERSION=$(rpm -q --qf '%{VERSION}' tis-waptserver 2>/dev/null || true)
fi

# Fallback: check waptserver config or binary
if [ -z "$VERSION" ] && [ -f /opt/wapt/waptserver/server.py ]; then
  VERSION=$(grep -oP '__version__\s*=\s*["\x27]\K[^"\x27]+' /opt/wapt/waptserver/server.py 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine WAPT Server version. Is tis-waptserver installed?"
  exit 2
fi

echo "Detected WAPT Server version: $VERSION"

# Normalize version for comparison (handle both X.Y.Z.BUILD and X.Y.Z formats)
# We need build number; affected range is 2.6.0.16767 - 2.6.1.17787, fixed at 2.6.1.17813
BUILD=$(echo "$VERSION" | grep -oP '\d+$' || echo "0")
MAJMINPATCH=$(echo "$VERSION" | grep -oP '^\d+\.\d+\.\d+' || echo "0.0.0")

# Check if version is in affected range
if [[ "$MAJMINPATCH" == "2.6.0" || "$MAJMINPATCH" == "2.6.1" ]]; then
  if [ "$BUILD" -ge 16767 ] && [ "$BUILD" -le 17787 ]; then
    echo "VULNERABLE - Version $VERSION is in the affected range (2.6.0.16767 - 2.6.1.17787)"
    echo "ACTION: Upgrade to 2.6.1.17813 or later immediately."
    exit 1
  elif [ "$BUILD" -ge 17813 ]; then
    echo "PATCHED - Version $VERSION includes the fix for CVE-2026-33591."
    exit 0
  elif [ "$BUILD" -lt 16767 ]; then
    echo "PATCHED - Version $VERSION predates the affected range. Verify independently."
    exit 0
  else
    echo "UNKNOWN - Version $VERSION is between 17787 and 17813; status unclear."
    exit 2
  fi
else
  echo "PATCHED - Version $VERSION ($MAJMINPATCH) is outside the affected 2.6.x range."
  exit 0
fi