Is CVE-2026-79980 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79980 being exploited in the wild.

How severe is CVE-2026-79980?

Medium severity, with a CVSS score of 5.6, published 23 October 2026.

Which products and versions are affected?

Zephyr Project prior to fix date 2026-10-23.

Is there a fix for CVE-2026-79980?

Yes: fixed in Fixed by drawing fresh random values from sys_rand32_get() at each transaction entry point (SELECTING, RENEWING, REBINDING, and INIT/INIT-REBOOT state transitions). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79980 attacked?

It is attacked over the network or from the adjacent network, in an operating system.

Am I affected by CVE-2026-79980?

Check whether you run Zephyr Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79980: Zephyr DHCPv4 client predictable transaction ID allows gateway hijacking

CVE-2026-79980 · Severity: medium · CVSS 5.6 · Published 2026-10-23

The DHCPv4 client in Zephyr uses predictable transaction identifiers instead of random ones, allowing attackers to forge DHCP replies. An attacker with access to the network segment can redirect the device's traffic through a malicious gateway or DNS server, causing all outbound connections to be intercepted and rerouted without authentication.

Vendors: Zephyr.

Quick answers

Is CVE-2026-79980 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79980 being exploited in the wild.
How severe is CVE-2026-79980?: Medium severity, with a CVSS score of 5.6, published 23 October 2026.
Which products and versions are affected?: Zephyr Project prior to fix date 2026-10-23.
Is there a fix for CVE-2026-79980?: Yes: fixed in Fixed by drawing fresh random values from sys_rand32_get() at each transaction entry point (SELECTING, RENEWING, REBINDING, and INIT/INIT-REBOOT state transitions). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79980 attacked?: It is attacked over the network or from the adjacent network, in an operating system.
Am I affected by CVE-2026-79980?: Check whether you run Zephyr Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fixed by drawing fresh random values from sys_rand32_get() at each transaction entry point (SELECTING, RENEWING, REBINDING, and INIT/INIT-REBOOT state transitions)

Technical details

The vulnerability is in subsys/net/lib/dhcpv4/dhcpv4.c where the transaction identifier (xid) is seeded once at startup and incremented sequentially rather than randomized per transaction. An attacker who observes the initial DHCPDISCOVER on the network segment can predict all future identifiers and forge DHCPACK/DHCPNAK replies that pass the client's validation checks (matching xid and client MAC). The forged replies execute their side effects (gateway and DNS configuration) before state machine validation, enabling gateway hijacking and DNS poisoning.

Affected products

Zephyr Zephyr Project prior to fix date 2026-10-23

Timeline

2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.