Is CVE-2026-86219 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86219 being exploited in the wild.

How severe is CVE-2026-86219?

Critical severity, with a CVSS score of 9.8, published 6 September 2026.

Which products and versions are affected?

Perl Authen::SASL::Perl before 2.2100.

Is there a fix for CVE-2026-86219?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86219 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86219?

Check whether you run Perl Authen::SASL::Perl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 nonce replay in server_step

CVE-2026-86219 · Severity: critical · CVSS 9.8 · Published 2026-09-06

Authen::SASL::Perl::DIGEST_MD5 is a Perl library that handles DIGEST-MD5 authentication, commonly used in email and messaging systems. Versions before 2.2100 fail to validate that the nonce received from a client matches the one sent in the server's challenge, allowing an attacker who observes one successful authentication session to replay the captured response against future sessions and gain unauthorized access without knowing the user's password.

Vendors: Perl.

Quick answers

Is CVE-2026-86219 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86219 being exploited in the wild.
How severe is CVE-2026-86219?: Critical severity, with a CVSS score of 9.8, published 6 September 2026.
Which products and versions are affected?: Perl Authen::SASL::Perl before 2.2100.
Is there a fix for CVE-2026-86219?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86219 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86219?: Check whether you run Perl Authen::SASL::Perl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass caused by insufficient nonce validation in the DIGEST_MD5 implementation. The server_start function generates a nonce and sends it in the challenge, but server_step does not verify that the nonce returned by the client matches the original server-issued nonce. Instead, it derives the expected digest solely from client-supplied parameters and the internally stored nonce table, keyed on the client-supplied (attacker-controlled) nonce. An attacker who captures a successful qop=auth exchange can replay that response in a later session for the same service, host, realm, and user, because the nonce validation check and replay counter (nc) check will both pass. The root cause is non-compliance with RFC 2831, which mandates that the server verify the nonce in the response against the value sent in the preceding challenge. No network-level authentication is required; an attacker only needs to have observed a prior successful exchange.

Affected products

Perl Authen::SASL::Perl before 2.2100

Timeline

2026-09-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.