Is CVE-2026-35089 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35089 being exploited in the wild.

How severe is CVE-2026-35089?

Informational severity, with a CVSS score of 8.7, published 27 May 2026.

Which products and versions are affected?

Slican CCT-1668 below 6.56.0430; Slican CXS-0424 below 6.30.0510; Slican IPx series below 6.61.0040; Slican MAC-6400 below 6.56.0430.

Is there a fix for CVE-2026-35089?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-35089 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35089?

Check whether you run Slican CCT-1668, Slican CXS-0424, Slican IPx series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35089: Slican telephone exchanges predictable secure key generation

CVE-2026-35089 · Severity: info · CVSS 8.7 · Published 2026-05-27

Slican telephone exchanges, used for managing corporate telephony and communications, contain a security flaw in how they generate encryption keys. An unauthorized person can predict these keys by gathering publicly available information about the device. This allows an attacker to recover administrative credentials, potentially leading to full control over the phone system and its data.

Technologies: Slican CCT-1668, Slican CXS-0424, Slican MAC-6400. Vendors: Slican.

Quick answers

Is CVE-2026-35089 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35089 being exploited in the wild.
How severe is CVE-2026-35089?: Informational severity, with a CVSS score of 8.7, published 27 May 2026.
Which products and versions are affected?: Slican CCT-1668 below 6.56.0430; Slican CXS-0424 below 6.30.0510; Slican IPx series below 6.61.0040; Slican MAC-6400 below 6.56.0430.
Is there a fix for CVE-2026-35089?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-35089 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35089?: Check whether you run Slican CCT-1668, Slican CXS-0424, Slican IPx series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as Use of Weak Credentials (CWE-1391). In affected Slican telephone exchanges, the secure key used for administrative access is generated using predictable device-specific properties. These properties can be retrieved by an unauthenticated attacker over the network. By deducing the key from these properties, an attacker can obtain administrative credentials. Patches are available for current models, but legacy hardware (versions 4.xx and below) requires a hardware upgrade to receive software fixes.

Affected products

Slican IPx series below 6.61.0040
Slican CCT-1668 below 6.56.0430
Slican MAC-6400 below 6.56.0430
Slican CXS-0424 below 6.30.0510

Timeline

2026-05-27: disclosed
2026-05-27: advisory

References

https://cert.pl/posts/2026/05/CVE-2026-35087

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.