Author: Marius Creutznacher
| Risk Category: High | Document ID: QSYS-October-19-9004 |
| Document Version: 1.0 | |
| Document Status: Final |
Description:
An authenticated attacker with network access to an affected Q-SYS Core may be able to abuse insufficient validation during the processing of uploaded package content. Because the affected operation interacts with privileged system resources, a successful attack could permit unauthorized modification of protected system content and lead to code execution with elevated privileges or complete device compromise. Exploitation requires valid Core Manager access and a network path to the management interface.
| CVE ID: | CVSS Vectors: | Score: |
| CVE-2026-88463 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/ SI:N/SA:L |
7.0 High |
Impacted Product Name
Q-SYS Core Processors
Impacted Versions
Q-SYS Designer Version lower than 10.5.0
Impacts on Installed System
Successful exploitation may affect the confidentiality, integrity, and availability of the affected device, including unauthorized system changes, service disruption, and full system compromise.
How to Diagnose Installed System
Confirm whether the installed Q-SYS Designer version is earlier than 10.5.0. Also verify that Core Manager Access Control is enabled and that management access is restricted to trusted users and networks.
Mitigation
- Update to Q-SYS Designer Version 10.5.0
- Restrict network access to trusted management networks, keep Core Manager Access Control enabled, protect administrator credentials and tokens, and prevent untrusted access to the device web interface.
Updated Version
Q-SYS 10.5
Issue Fixed Date
29 September 2026
Attribution
National Test Institute for Cybersecurity NTC, https://www.ntc.swiss/
Acuity knows of no exploitation of these vulnerabilities.
LEGAL DISCLAIMER:
THIS CONTENT IS PROVIDED ON AN "AS IS" BASIS FOR INFORMATIONAL PURPOSES ONLY AND IS PROVIDED WITHOUT ANY WARRANTY OF ANY KIND. THE CONTENT IS INTENDED FOR USERS OF ACUITY PRODUCTS WHO POSSESS THE PROFESSIONAL SKILLS AND JUDGMENT NECESSARY TO INTERPRET THE INFORMATION AND DETERMINE THE APPROPRIATE STEPS TO TAKE. USE OF THE INFORMATION IS AT THE USER'S OWN RISK. THE AUTHOR RESERVES THE RIGHT TO UPDATE OR DELETE THIS CONTENT AT ANY TIME.
