Is CVE-2026-18796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18796 being exploited in the wild.

How severe is CVE-2026-18796?

Informational severity, published 7 September 2026.

Which products and versions are affected?

Nordic Semiconductor nRF5340 all versions.

Is there a fix for CVE-2026-18796?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18796 attacked?

It is attacked with physical access, in device firmware.

Am I affected by CVE-2026-18796?

Check whether you run Nordic Semiconductor nRF5340 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18796: Nordic Semiconductor nRF5340 external QSPI flash encryption weakness

CVE-2026-18796 · Severity: info · Published 2026-09-07

The nRF5340 microcontroller's external QSPI flash encryption mechanism for execute-in-place (XIP) code contains a fundamental weakness in its on-the-fly decryption scheme. Applications relying on this encryption to protect externally stored code confidentiality or integrity are exposed to potential data leakage or code tampering. An attacker with physical access to the QSPI flash storage could potentially read or modify encrypted code without requiring the encryption key.

Vendors: Nordic Semiconductor.

Quick answers

Is CVE-2026-18796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18796 being exploited in the wild.
How severe is CVE-2026-18796?: Informational severity, published 7 September 2026.
Which products and versions are affected?: Nordic Semiconductor nRF5340 all versions.
Is there a fix for CVE-2026-18796?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18796 attacked?: It is attacked with physical access, in device firmware.
Am I affected by CVE-2026-18796?: Check whether you run Nordic Semiconductor nRF5340 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability exists in the on-the-fly decryption scheme used by the nRF5340 for external QSPI flash XIP (Execute In Place) operations, affecting all applications that depend on this encryption for code confidentiality or integrity protection. The weakness is not version-specific to nRF Connect SDK but rather a fundamental design flaw in how the decryption mechanism operates. The attack vector requires physical access to the QSPI flash memory and knowledge of the encryption scheme. An attacker can leverage this weakness to decrypt stored code, extract sensitive firmware logic, or inject modified code into the flash storage. No patch status is currently documented, as this represents an architectural limitation rather than a traditional software bug.

Affected products

Nordic Semiconductor nRF5340 all versions

Timeline

2026-09-07: disclosed

References

https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.