Is CVE-2026-92693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92693 being exploited in the wild.

How severe is CVE-2026-92693?

High severity, with a CVSS score of 8.2, published 5 November 2026.

How is CVE-2026-92693 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-92693?

Check whether you run FastNetMon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92693: FastNetMon out-of-bounds read in IPv6 fragment header parser

CVE-2026-92693 · Severity: high · CVSS 8.2 · Published 2026-11-05

FastNetMon is a network security tool that detects distributed denial-of-service attacks by analyzing packet flows. An attacker can send a specially crafted network packet over the internet to trigger an out-of-bounds memory read in FastNetMon's packet parser, potentially exposing sensitive data or crashing the detection system. The vulnerability requires no authentication and can be exploited remotely with a single packet sent to the sFlow collector port.

Technologies: FastNetMon. Vendors: FastNetMon.

Quick answers

Is CVE-2026-92693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92693 being exploited in the wild.
How severe is CVE-2026-92693?: High severity, with a CVSS score of 8.2, published 5 November 2026.
Which products and versions are affected?: FastNetMon 1.2.9 and earlier.
Is there a fix for CVE-2026-92693?: No fixed version is recorded yet. Restrict network access to the sFlow UDP collector port to trusted monitoring sources only, reducing the attack surface until a patched version is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92693 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-92693?: Check whether you run FastNetMon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict network access to the sFlow UDP collector port to trusted monitoring sources only, reducing the attack surface until a patched version is available.

Technical details

The parse_raw_packet_to_simple_packet_full() function in simple_packet_parser_ng.cpp dereferences an 8-byte IPv6 Fragment extension header structure without verifying sufficient bytes remain in the packet buffer. When an sFlow v5 RAW_PACKET_HEADER record arrives with the Fragment header truncated or omitted, the parser reads past the buffer boundary. The sFlow UDP collector invokes this parser directly on untrusted input, making it reachable remotely and unauthenticated.

Affected products

FastNetMon FastNetMon 1.2.9 and earlier

Timeline

2026-07-20: disclosed
2026-11-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.