# CVE-2026-59776: Sony FeliCa IC chips missing cryptographic step

Source: https://junglewise.ai/threats/cve-2026-59776-sony-felica-ic-chips-missing-cryptographic-step  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-59776 · Severity: medium · CVSS 6.8 · Published 2026-07-21

A security flaw exists in certain Sony FeliCa IC chips, which are widely used in contactless smart cards for transit, payments, and access control. If an attacker gains physical access to a card, they may be able to bypass security protections to read or modify the data stored on the chip. This could lead to unauthorized access to services or the tampering of digital balances and identity information.

Vendors: [Sony](https://junglewise.ai/threats/vendors/sony).

## Quick answers

**Is CVE-2026-59776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59776 being exploited in the wild.

**How severe is CVE-2026-59776?** Medium severity, with a CVSS score of 6.8, published 21 July 2026.

**Which products and versions are affected?** Sony FeliCa IC chips shipped in or before 2017.

**Is there a fix for CVE-2026-59776?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59776 attacked?** It is attacked with physical access, in device firmware.

**Am I affected by CVE-2026-59776?** Check whether you run Sony FeliCa IC chips at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Missing Cryptographic Step (CWE-325) vulnerability exists in the firmware of certain Sony FeliCa IC chips manufactured and shipped in or before 2017. The flaw occurs during specific cryptographic processing operations, which fails to maintain the intended security strength of the chip's data protection mechanisms. An attacker with physical access to the IC chip can exploit this weakness to perform unauthorized read or write operations on the stored data. While the vulnerability is hardware-based, Sony has issued mitigation guidelines to service providers to enhance system-level security. No software patch is available for the physical chips themselves due to their hardware nature.

## Affected products

- Sony Corporation FeliCa IC chips shipped in or before 2017

## Timeline

- 2025-08-28: other: Initial internal confirmation by Sony
- 2026-07-21: advisory: Public disclosure via JVN and Sony update
- 2026-07-21: disclosed: CVE-2026-59776 published

## References

- [https://jvn.jp/en/jp/JVN40509781/](https://jvn.jp/en/jp/JVN40509781/)
- [https://www.sony.co.jp/en/Products/felica/business/information/2025001.html](https://www.sony.co.jp/en/Products/felica/business/information/2025001.html)