CVE-2026-2844

The vulnerability results from omission of an authentication mechanism for specific critical functions in the TimePictra application. A remote attacker, without the need to possess an account or permissions, can directly invoke these functions over the network. This results in the ability to manipulate system configuration or its operating environment without any identity verification.

An attacker can remotely modify system configuration or its operating environment without authentication, which may lead to disruption of time synchronization, takeover of device settings control, and violation of system data integrity and confidentiality.

Patches available from the vendor should be applied in accordance with references. Detailed information about updates is available at the address indicated by Microchip in the official security bulletin. Until patches are applied, it is recommended to limit network access to the TimePictra system through a firewall or network segmentation.

Microchip TimePictra in versions 11.0 to 11.3 SP2 (inclusive).