Unauthenticated Asset Administration Shell Data Modification

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-94293 represents a critical authentication bypass vulnerability affecting Asset Administration Shell (AAS) implementations, with a CVSS score of 9.8. An unauthenticated remote attacker can exploit missing access controls (CWE-306) to both read sensitive data through GET endpoints and modify critical submodel data via PATCH requests. This vulnerability impacts industrial control systems, manufacturing environments, and any infrastructure relying on AAS for asset management and interoperability. The lack of authentication requirements means any network-accessible AAS instance becomes immediately exploitable without credentials, enabling attackers to exfiltrate configuration data, manipulate asset parameters, and potentially disrupt operational technology environments.

Casky's 283 mapped skills detect the attack patterns behind this vulnerability by correlating evidence across MITRE ATT&CK Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. When Claude AI applies extended reasoning to network telemetry and API logs, practitioners will identify suspicious patterns: unauthenticated PATCH requests modifying AAS submodel objects, repeated GET requests accessing sensitive endpoints without valid credentials, and anomalous data modifications from unexpected source IPs. Casky's skill framework flags the absence of authentication tokens in requests, unexpected HTTP methods targeting administrative endpoints, and the suspicious combination of read and write operations from single unauthenticated sessions—providing practitioners with precise behavioral indicators that distinguish this exploitation from legitimate administrative traffic.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-94293.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-94293

Casky has 283 skills that investigate the attack patterns behind CVE-2026-94293. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn