CVE-2026-7251: exploitation status and patch state

CVE-2026-7251 · CVSS 9.8 CRITICAL

Eppendorf BioFlo 320 is vulnerable to due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.

Is CVE-2026-7251 exploited?

• Not in the CISA KEV catalog.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-7251

• Fixed VNC Password Exposes BioFlo 320 Control (2026-05-26)

Primary sources

• NVD record

What this record does not say

• No EPSS score.
• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.