Quick answers
- Is CVE-2026-92694 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92694 being exploited in the wild.
- How severe is CVE-2026-92694?
- Medium severity, with a CVSS score of 5.9, published 5 November 2026.
- Which products and versions are affected?
- FastNetMon 1.2.9 and earlier.
- Is there a fix for CVE-2026-92694?
- A patch was published on 2026-07-20: Fix merged in commit 1294724 and PR #1087 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-92694 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-92694?
- Check whether you run FastNetMon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A race condition exists in draw_table_ipv6() where the function reads ipv6_host_counters.average_speed_map without holding counter_map_mutex, while recalculate_speed() may concurrently insert keys and rehash the same map. The vulnerability requires that networks_list includes the targeted IPv6 range. This causes undefined behavior under load; a crash is plausible but unconfirmed, and reliable denial of service has not been demonstrated.
Affected products
- FastNetMon FastNetMon 1.2.9 and earlier
Timeline
- 2026-11-05: disclosed
- 2026-07-20: patched: Fix merged in commit 1294724 and PR #1087