A vulnerability in Wapt Server before version 2.6.1.17813 allows a  remote unauthenticated attacker to…

CVE-2026-33591 is an authentication bypass (CWE-288) in Tranquil IT's WAPT Server, an enterprise software deployment and patch management platform. By sending a specially crafted network packet, a remote unauthenticated attacker can retrieve a valid session token for any targeted account — including the admin console. Affected versions span 2.6.0.16767 through 2.6.1.17787; the fix lands in 2.6.1.17813. Both WAPT Enterprise and Community editions are vulnerable.

The CNA (ENISA) scored this CVSS 4.0 10.0, and for once the top-of-scale rating is directionally correct — though CVSS 4.0 10s are mechanically common for unauthenticated remote bugs, the blast radius here genuinely justifies alarm. WAPT Server's *entire purpose* is pushing software packages to managed endpoints. An attacker who steals an admin session token does not just read data — they gain the ability to push arbitrary payloads fleet-wide, turning a single auth bypass into a supply-chain-grade compromise vector. The narrow installed base (primarily French and francophone enterprises) is the only real friction, and it doesn't change the severity for organizations that actually run WAPT.

Why this verdict

• Unauthenticated remote, zero-interaction attack: The auth bypass requires no credentials, no user interaction, and low attack complexity — a single crafted packet yields a valid admin session token. This is the most dangerous attack surface profile possible.
• Role multiplier — canonical fleet deployment server: WAPT Server exists solely to push software packages to managed endpoints. 100% of installations are in this high-value role. Admin access → push arbitrary packages → SYSTEM-level code execution on every managed host. The blast radius is fleet-scale by design, meeting the CRITICAL floor rule.
• Patch has been available for ~2 months but CVE just published: The vendor advisory went out 2026-06-09 but the CVE was only published 2026-08-03. Organizations relying on CVE feeds for prioritization have been flying blind — unpatched instances have had extended exposure.
• Low friction once network access is achieved: No complex exploit chain, no race conditions, no memory corruption — this is a logic bug in the authentication path. Reliability is expected to be near-100% once the packet structure is understood.

Why not higher?

This is already assessed at CRITICAL (9.2). The 0.8-point deduction from a theoretical 10.0 reflects the absence of confirmed in-the-wild exploitation, no public PoC, and the product's niche installed base which limits the total population at risk. If a PoC drops or KEV listing occurs, the score would move toward 9.8.

Why not lower?

Downgrading below CRITICAL is blocked by the deployment-role floor rule. WAPT Server is *by definition* a fleet management platform — every installation is a high-value supply-chain node. The unauthenticated remote auth bypass converts to fleet-wide code execution in four trivial steps. Internal-network-only exposure is typical for management servers and does not reduce severity for the organizations that run them; it merely reduces the *internet-reachable* attack surface, which is a population filter, not a severity filter.

1. Restrict WAPT Server network access to management VLAN only — Immediately firewall the WAPT Server so only authorized admin workstations and WAPT agents can reach its HTTPS port. This eliminates the attack from general internal network positions. Deploy within 3 days per noisgate mitigation SLA for CRITICAL findings.
2. Monitor WAPT Server access logs for session anomalies — Alert on session-grant events that lack a corresponding authentication event or originate from unexpected source IPs. This detects exploitation attempts. Deploy within 3 days.
3. Audit WAPT package integrity — Review all packages currently staged in the WAPT repository for unauthorized modifications. Compare hashes against known-good baselines. If external code-signing is available, enforce signature validation on agents.
4. Apply patch to version 2.6.1.17813 — This is the definitive remediation. The patch has been available since June 2026. Apply within the noisgate remediation SLA of 90 days for CRITICAL, but given the trivial exploitability, treat this as urgent — patch within days, not weeks.

Run this script on the WAPT Server host (Linux) as any user with read access to the WAPT configuration. Invoke with: bash check_cve_2026_33591.sh. No elevated privileges required — it only reads the installed package version.

#!/usr/bin/env bash
# check_cve_2026_33591.sh
# Checks whether the installed WAPT Server version is vulnerable to CVE-2026-33591
# Affected: 2.6.0.16767 through 2.6.1.17787
# Fixed:    2.6.1.17813+
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

# Try to get WAPT version from dpkg (Debian/Ubuntu) or rpm (RHEL/CentOS)
VERSION=""
if command -v dpkg-query &>/dev/null; then
  VERSION=$(dpkg-query -W -f='${Version}' tis-waptserver 2>/dev/null || true)
elif command -v rpm &>/dev/null; then
  VERSION=$(rpm -q --qf '%{VERSION}' tis-waptserver 2>/dev/null || true)
fi

# Fallback: check waptserver config or binary
if [ -z "$VERSION" ] && [ -f /opt/wapt/waptserver/server.py ]; then
  VERSION=$(grep -oP '__version__\s*=\s*["\x27]\K[^"\x27]+' /opt/wapt/waptserver/server.py 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine WAPT Server version. Is tis-waptserver installed?"
  exit 2
fi

echo "Detected WAPT Server version: $VERSION"

# Normalize version for comparison (handle both X.Y.Z.BUILD and X.Y.Z formats)
# We need build number; affected range is 2.6.0.16767 - 2.6.1.17787, fixed at 2.6.1.17813
BUILD=$(echo "$VERSION" | grep -oP '\d+$' || echo "0")
MAJMINPATCH=$(echo "$VERSION" | grep -oP '^\d+\.\d+\.\d+' || echo "0.0.0")

# Check if version is in affected range
if [[ "$MAJMINPATCH" == "2.6.0" || "$MAJMINPATCH" == "2.6.1" ]]; then
  if [ "$BUILD" -ge 16767 ] && [ "$BUILD" -le 17787 ]; then
    echo "VULNERABLE - Version $VERSION is in the affected range (2.6.0.16767 - 2.6.1.17787)"
    echo "ACTION: Upgrade to 2.6.1.17813 or later immediately."
    exit 1
  elif [ "$BUILD" -ge 17813 ]; then
    echo "PATCHED - Version $VERSION includes the fix for CVE-2026-33591."
    exit 0
  elif [ "$BUILD" -lt 16767 ]; then
    echo "PATCHED - Version $VERSION predates the affected range. Verify independently."
    exit 0
  else
    echo "UNKNOWN - Version $VERSION is between 17787 and 17813; status unclear."
    exit 2
  fi
else
  echo "PATCHED - Version $VERSION ($MAJMINPATCH) is outside the affected 2.6.x range."
  exit 0
fi

Sources

1. NVD - CVE-2026-33591
2. WAPT Security Bulletin (Vendor Advisory)
3. WAPT Security Bulletin (French)
4. Tranquil IT Forum - Version 2.6.1.17813 Discussion
5. CISA Weekly Vulnerability Summary (2026-06-29)
6. FIRST EPSS Model
7. WAPT Official Documentation