Am I Patched? Check a Niagara 4 Version Against 11 Tracked CVEs

Page updated October 30, 2026. Data last verified 2026-10-30.

Short answer: Type your Niagara 4 version (for example 4.14u5 or 4.15.1) and the checker lists which of the 11 CVEs it tracks affect that version, with the fixed release for each. It covers the 4.10, 4.14 and 4.15 branches only. It reads your version number and nothing else, so it doesn't know about patch jars you've applied. Confirm the result against the vendor bulletins: SB 2026-Tridium-1 and SB 2025-Tridium-1.

Check your version

Update level N (e.g. 4.14u5) is treated as 4.14.5. Confirm the exact build in your platform details against the vendor bulletin.

What the result means

"N known CVE(s) affect [version]" means your update number is below the fixed release listed for your branch, for each CVE shown. Each card gives the CVE ID, score, severity, a summary and the release that fixes it. "No tracked CVEs affect this version" means none of the 11 CVEs on this site match your version number. It does not mean the system has no other vulnerabilities. If your branch has no fixed release listed, the checker says so.

Quick answers

• Is 4.15u4 vulnerable? Yes, to CVE-2026-11804, unless the patch jar program-rt-4.15.4.24.1.jar is applied. Fixed in 4.15u5.
• Is 4.14u5 vulnerable? Yes, to CVE-2026-11804, unless the patch jar program-rt-4.14.5.22.1.jar is applied. Fixed in 4.14u6.
• What fixes the 2025 CVEs (CVE-2025-3936 to 3945)? Tridium names 4.14u2. KMC lists 4.10u11, 4.14u2 and 4.15u1 (KMC notice).
• Does it cover Niagara AX or Niagara 5 (N5)? No.

Which versions and CVEs it covers

Niagara 4 branches 4.10, 4.14 and 4.15. It tracks 11 CVEs: CVE-2025-3936 to CVE-2025-3945 (SB 2025-Tridium-1) and CVE-2026-11804 (SB 2026-Tridium-1). This is not every Niagara CVE ever published. Older Niagara AX issues, for example, are not included. Full list: current CVEs and fixes.

What it does not check

• Patch jars (program-rt-*.jar) you've applied. It reads the version number only.
• Your station, its configuration or Security Dashboard.
• Niagara AX, Niagara 5, or OEM-branded builds.
• Branches other than 4.10, 4.14 and 4.15.

The check runs in your browser. Nothing you type is sent anywhere.

Where the data comes from and when it was last verified

Fixed releases and scores come from the Honeywell/Tridium bulletins, with links to each CVE's NVD record. Data last verified 2026-10-30. Scores differ by source: the scores shown are Honeywell's (the vendor's). NVD gives higher scores for most of the 2025 CVEs, up to 9.8, and some aggregators repeat NVD's figure. The CVE table shows both where they differ. Dates differ too: SB 2026-Tridium-1 is dated July 2, 2026, and NVD published CVE-2026-11804 on July 23, 2026.

Related dates

Tridium plans updates for 4.15, the last Niagara 4 release, through Q3 2028. See Niagara 4 end of support and Niagara 4.15 vulnerabilities. All vendor dates are planned and can change.

Get new CVEs and fixes in your inbox: subscribe to the Niagara Tracker Bulletin.

Niagara Tracker (n5tracker) is an independent resource. It is not connected to "nTracker".