{"metadata": {"vulnerability": "CVE-2026-59104", "count": 15, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-07-02T15:47:36.964Z", "date_only": false, "value": "2026-07-02T15:47:36.964Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-59104", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T21:41:49.884Z", "date_only": false, "value": "2026-11-06T21:41:49.884Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59104", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-06T21:41:49.884Z", "date_only": false, "value": "2026-11-06T21:41:49.884Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-59104", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T21:41:49.884Z", "date_only": false, "value": "2026-11-06T21:41:49.884Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ENISA", "record": "CVE-2026-59104", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T21:49:02.072Z", "date_only": false, "value": "2026-11-06T21:49:02.072770Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117571698136423121", "record": "cve-2026-59104", "field": "creation_timestamp", "uuid": "066fd6aa-b6d5-42a7-b37d-835012a1343d", "content": "CVE-2026-59104 UgCS server HCI authentication bypass with empty credentials UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \\\"use the only user\\\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59104https://www.ugcs.com/https://offseq.com/en/research/ugcs-cve-2026-59104/#ugcs #SPHEngineering #UgCS#CVE_2026_59104#bot", "url": "https://infosec.exchange/users/cve/statuses/117571698136423121"}, {"timestamp": "2026-11-06T22:17:59Z", "date_only": false, "value": "2026-11-06T22:17:59Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8F29-C49M-PQ4G", "record": "GHSA-8F29-C49M-PQ4G", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-06T22:17:59.043Z", "date_only": false, "value": "2026-11-06T22:17:59.043", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59104", "record": "FKIE_CVE-2026-59104", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T22:17:59.043Z", "date_only": false, "value": "2026-11-06T22:17:59.043", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59104", "record": "FKIE_CVE-2026-59104", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T23:51:00.470Z", "date_only": false, "value": "2026-11-06T23:51:00.470816Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3mzrhzjkumpfw", "record": "cve-2026-59104", "field": "creation_timestamp", "uuid": "8d8b474c-9b74-4809-8f48-a95c8c095e22", "content": "Developing: Critical UgCS Vulnerability (CVE-2026-59104)\nhttps://cyber.eventmonitor.net/incident/EM-20261106-ET8C/critical-ugcs-vulnerability-cve-2026-59104/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3mzrhzjkumpfw"}, {"timestamp": "2026-11-07T00:07:48.091Z", "date_only": false, "value": "2026-11-07T00:07:48.091977Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzom4gga452v", "record": "CVE-2026-59104", "field": "creation_timestamp", "uuid": "1cf3bbdf-bc63-439e-8cf7-016612d3cac0", "content": "\ud83d\udea8 CVE-2026-59104 \u2014 CVSS 9.3 CRITICAL\n\nUgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) e...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-59104\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzom4gga452v"}, {"timestamp": "2026-11-07T00:31:24Z", "date_only": false, "value": "2026-11-07T00:31:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8F29-C49M-PQ4G", "record": "GHSA-8F29-C49M-PQ4G", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T00:31:24Z", "date_only": false, "value": "2026-11-07T00:31:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8F29-C49M-PQ4G", "record": "GHSA-8F29-C49M-PQ4G", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-07T00:47:15.615Z", "date_only": false, "value": "2026-11-07T00:47:15.615977Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzoocxvbme26", "record": "CVE-2026-59104", "field": "creation_timestamp", "uuid": "d4ee643e-06ee-4f94-a94a-a1e743ea03dd", "content": "\ud83d\udd34 CVE-2026-59104 - Critical (9.8)\n\nUgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (Login...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-59104/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzoocxvbme26"}, {"timestamp": "2026-11-07T01:30:35.110Z", "date_only": false, "value": "2026-11-07T01:30:35.110162Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117572569242866491", "record": "CVE-2026-59104", "field": "creation_timestamp", "uuid": "155d9e96-3df3-4927-8987-4f384c76cc5c", "content": "UgCS server <6.2 has a CRITICAL auth bypass (CVE-2026-59104): remote attackers can gain full access if only one user exists by sending empty credentials to TCP 3334. Restrict access & review configs. https://radar.offseq.com/threat/ugcs-server-before-62-contains-an-authentication-bypass-in-the-hci-protocol-login-handler-cve-2026-91397bd61727d242 #OffSeq #CVE202659104 #drone #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117572569242866491"}, {"timestamp": "2026-11-07T01:50:05.587Z", "date_only": false, "value": "2026-11-07T01:50:05.587622Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzortdukec2o", "record": "CVE-2026-59104", "field": "creation_timestamp", "uuid": "ae6322ca-0ef1-4a0c-b8bf-0ed538d35b46", "content": "CVE-2026-59104 - ugcs\nThe UgCS server (version before 6.2) accepts an empty username and password when only one user exists, granting full access. Because the service listens on all network interfaces\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ugcs #sphengineering #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzortdukec2o"}], "metrics": {"as_of": "2026-11-08T04:28:18.186Z", "anchors": {"origin": {"timestamp": "2026-11-06T21:41:49.884Z", "date_only": false, "value": "2026-11-06T21:41:49.884Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59104", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-06T21:41:49.884Z", "date_only": false, "value": "2026-11-06T21:41:49.884Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59104", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 110788.30243, "hours": 30.774528452777776, "days": 1.2822720188657406, "min_seconds": 110788.30243, "max_seconds": 110788.30243, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-06T21:41:49.884Z", "date_only": false, "value": "2026-11-06T21:41:49.884Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59104", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T04:28:18.186Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}