Niagara 4.15 Vulnerabilities: CVEs, Affected Builds and Fixes
Facts read October 30, 2026.
Quick answer
Niagara 4.15 builds before 4.15u5 are affected by CVE-2026-11804 (NVD). Update to 4.15u5, or apply the patch jar from Tridium's bulletin.
CVE-2026-11804: program module privilege escalation
Security bulletin SB 2026-Tridium-1 (defect PSIRT-1463), dated July 2, 2026, covers a privilege escalation issue in the program module. CVSS 3.1 score 5.2 (vector AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), as scored by Honeywell (bulletin PDF). Listed affected: Niagara Framework 4.14u5 and 4.15u4, and Niagara Enterprise Security. NVD lists the Framework as affected before 4.14.6 and before 4.15.5.
Fixed versions and patch jars
- Niagara 4.15u5 or 4.14u6 (Framework and Enterprise Security)
- Patch jars:
program-rt-4.15.4.24.1.jar,program-rt-4.14.5.22.1.jar
Available from Niagara Central, your sales support channel, or Tridium support (bulletin). 4.15u1 does not fix this CVE.
Has it been exploited?
We found no report of exploitation. Do not treat that as a guarantee; check NVD and CISA for updates.
The 2025 batch: CVE-2025-3936 to CVE-2025-3945
Bulletin SB 2025-Tridium-1 lists these as affecting 4.10u10, 4.14u1 and 4.15 (Honeywell PDF). Fixed releases are 4.10u11, 4.14u2 and 4.15u1 (KMC bulletin; confirm with Tridium). Full list on the CVE page.
If you cannot update yet
- Review users who can authenticate to Niagara
- Limit physical access, including Ethernet ports
- Use a VPN for remote connections
- Sign third-party modules and program objects
- Follow the Niagara Hardening Guide; review the Security Dashboard
Source: SB 2026-Tridium-1.
Get changes like this in your inbox: subscribe to the Niagara Tracker Bulletin. Check your build on the Am I patched? page.