CVE-2026-13742 Lack of signature verification before execution of downloaded content
Attackers can replace downloaded files with malicious ones due to missing signature verification, leading to code execution on Honeywell IQ MultiAccess systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13742?
CVE-2026-13742 is a medium-severity code injection vulnerability in Honeywell Technologies IQ MultiAccess, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. An attacker could potentially exploit this vulnerability, leading to the replacement of downloaded file with a malicious one. Honeywell also recommends updating to the most recent version of this product, service, or offering [V27 SP1, V28 SP1]
Weakness: CWE-367
Which versions are affected by CVE-2026-13742?
How do I fix CVE-2026-13742?
No fix has been published for CVE-2026-13742 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-13742 being exploited?
There is no known exploitation of CVE-2026-13742 in the wild and no public exploit code.
Sources
Also known as GHSA-93h9-2372-g58v.