CVE-2026-77974

8.5 highEPSS 0.3%

High (8.5). EPSS 0.3% chance of exploitation in the next 30 days.

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.0 high

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-09-09
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

References

https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-251-01.json

Check your stack JSON