Quick answers
- Is CVE-2026-78135 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78135 being exploited in the wild.
- How severe is CVE-2026-78135?
- Medium severity, with a CVSS score of 5.6, published 11 September 2026.
- Which products and versions are affected?
- strongSwan 5.9.7 through 6.0.7.
- Is there a fix for CVE-2026-78135?
- A patch was published on 2026-09-07: Fixed in strongSwan 6.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78135 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78135?
- Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass in libcharon's IKEv2 state machine implementation. The root cause is a missing state check when processing CREATE_CHILD_SA requests on unestablished IKE SAs: the state validation only applies when no passive tasks are queued, but when EAP authentication is used, passive tasks remain queued during authentication, allowing the check to be bypassed. An unauthenticated peer can send a CREATE_CHILD_SA request during IKE SA initiation to create a usable child SA before authentication completes. The attack requires either that the responder does not configure an IP address pool or uses explicit remote traffic selectors. The vulnerability affects strongSwan 5.9.7 through 6.0.7 and is fixed in 6.1.0.
Affected products
- strongSwan strongSwan 5.9.7 through 6.0.7
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in strongSwan 6.1.0