{"id":"CVE-2025-40760","aliases":["EUVD-2025-99096","GHSA-cfqh-hp29-cjq6"],"status":"published","title":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected...","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.\r\nThis could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00141,"percentile":0.03449,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-209"],"published":"2025-11-11T20:20:35Z","modified":"2026-10-23T22:10:00Z","products":[{"vendor":"siemens","product":"altair grid engine"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-514895.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40760"},{"url":"https://github.com/advisories/GHSA-cfqh-hp29-cjq6"}],"sources":{"cve":[{"id":"CVE-2025-40760","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.\r\nThis could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.","status":"published","published":"2025-11-11T20:20:35.579Z","modified":"2025-11-12T19:30:50.394Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-99096","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.\r\nThis could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.","status":"published","published":"2025-11-11T20:20:35Z","modified":"2025-11-12T19:30:50Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:18.397537Z"}],"ghsa":[{"id":"GHSA-cfqh-hp29-cjq6","title":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected...","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.\nThis could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.","status":"published","published":"2025-11-11T21:30:28Z","modified":"2025-11-11T21:30:39Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:04:45.192533Z"}],"nvd":[{"id":"CVE-2025-40760","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.\r\nThis could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.","status":"published","published":"2025-11-11T21:15:37.733Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:11:43.650381Z"}]}}