How severe is CVE-2026-25086?

CVE-2026-25086 has a CVSS 3.x base score of 7.7, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-25086 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-25086?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-25086 have an EU (EUVD) identifier?

Yes. CVE-2026-25086 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13844.

When was CVE-2026-25086 published?

CVE-2026-25086 was published on 2026-03-21 and last updated on 2026-06-17.

CVE-2026-25086

CVE-2026-25086 is a high-severity vulnerability with a CVSS 3.x base score of 7.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-605.

Key facts

Severity: High (CVSS 3.x base score 7.7)
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-13844
Weakness: CWE-605
Published: 2026-03-21
Last modified: 2026-06-17

Description

Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.

Frequently asked questions

What is CVE-2026-25086?: Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.
How severe is CVE-2026-25086?: CVE-2026-25086 has a CVSS 3.x base score of 7.7, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-25086 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-25086?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-25086 have an EU (EUVD) identifier?: Yes. CVE-2026-25086 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13844.
When was CVE-2026-25086 published?: CVE-2026-25086 was published on 2026-03-21 and last updated on 2026-06-17.

References

Other CWE-605 vulnerabilities

CVE-2024-30218 — Medium (CVSS 6.5): The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users…
CVE-2025-15320 — Low (CVSS 3.3): Tanium addressed a denial of service vulnerability in Tanium Client.

Browse all CWE-605 vulnerabilities →