Quick answers
- Is CVE-2026-78126 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78126 being exploited in the wild.
- How severe is CVE-2026-78126?
- Medium severity, with a CVSS score of 5.9, published 11 September 2026.
- Which products and versions are affected?
- strongSwan 4.1.10 through 6.0.7.
- Is there a fix for CVE-2026-78126?
- A patch was published on 2026-09-07: Fixed in strongSwan 6.1.0 released September 7, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78126 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78126?
- Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a NULL pointer dereference in the eap-aka plugin when processing an unexpected AKA-Synchronization-Failure message before the server has issued an AKA-Challenge. The eap-aka plugin implements RFC 4187 and by default requests an identity from the peer before sending a challenge. If a peer responds to the identity request with an AKA-Synchronization-Failure message, the plugin attempts to reuse the RAND value that was never allocated (remaining NULL), causing a crash. No authentication is required; the attacker must be able to reach the VPN server over the network. Remote code execution is not possible. The vulnerability affects strongSwan 4.1.10 through 6.0.7; it was fixed in version 6.1.0 released September 7, 2026.
Affected products
- strongSwan strongSwan 4.1.10 through 6.0.7
Timeline
- 2026-09-07: disclosed: Vulnerability disclosed by strongSwan project
- 2026-09-07: patched: Fixed in strongSwan 6.1.0 released September 7, 2026