Is CVE-2026-6805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6805 being exploited in the wild.

How severe is CVE-2026-6805?

High severity, with a CVSS score of 7.5, published 7 May 2026.

Which products and versions are affected?

Thales Group Cryptobox 4.37.248 to 4.38.0; fixed in 4.40 hotfix 5 (4.40.183).

Is there a fix for CVE-2026-6805?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6805 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6805?

Check whether you run Thales Group Cryptobox or Thalesgroup Ercom Cryptobox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6805: Thales Cryptobox information disclosure in external sharing feature

CVE-2026-6805 · Severity: high · CVSS 7.5 · Published 2026-05-07

A vulnerability in the Cryptobox secure file-sharing platform could allow unauthorized individuals to access shared files. If an attacker obtains a valid sharing link, they can retrieve specific server information that enables them to bypass the link's access code through offline guessing. This could lead to the exposure of sensitive documents intended to be protected by a password or PIN.

Vendors: Thalesgroup.

Quick answers

Is CVE-2026-6805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6805 being exploited in the wild.
How severe is CVE-2026-6805?: High severity, with a CVSS score of 7.5, published 7 May 2026.
Which products and versions are affected?: Thales Group Cryptobox 4.37.248 to 4.38.0; fixed in 4.40 hotfix 5 (4.40.183).
Is there a fix for CVE-2026-6805?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6805 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6805?: Check whether you run Thales Group Cryptobox or Thalesgroup Ercom Cryptobox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the external sharing feature of Thales Cryptobox due to improper handling of server-side information related to shared links. An unauthenticated attacker who possesses a valid sharing URL can retrieve metadata or cryptographic material from the server that facilitates an offline brute-force attack against the access code (PIN/password) protecting the share. This bypasses the rate-limiting or account lockout protections typically associated with online authentication attempts. The issue is addressed in Cryptobox version 4.40 hotfix 5 (Helm Chart 4.40.183).

Affected products

Thales Group Cryptobox 4.37.248 to 4.38.0; fixed in 4.40 hotfix 5 (4.40.183)

Timeline

2026-05-07: disclosed
2026-05-07: advisory
2026-05-11: other: NVD analysis completed

References

https://info.cryptobox.com/doc/v4.40/4.40.en/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.