How severe is CVE-2026-76945?

CVE-2026-76945 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-76945 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-76945?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-76945 published?

CVE-2026-76945 was published on 2026-08-28 and last updated on 2026-08-31.

CVE-2026-76945

CVE-2026-76945 is a high-severity vulnerability with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-603.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 8.7
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-603
Published: 2026-08-28
Last modified: 2026-08-31

Description

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.

Frequently asked questions

What is CVE-2026-76945?: The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.
How severe is CVE-2026-76945?: CVE-2026-76945 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-76945 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-76945?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-76945 published?: CVE-2026-76945 was published on 2026-08-28 and last updated on 2026-08-31.

References

Other CWE-603 vulnerabilities

CVE-2026-71187 — Critical (CVSS 9.8): The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An…
CVE-2026-1363 — Critical (CVSS 9.8): IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing…
CVE-2025-12868 — Critical (CVSS 9.8): New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated…
CVE-2024-39375 — Critical (CVSS 9.8): TELSAT marKoni FM Transmitters are vulnerable to an attacker bypassing authentication and gaining administrator…
CVE-2022-33139 — Critical (CVSS 9.8): A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All…
CVE-2025-64119 — Critical (CVSS 9.3): A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery…

Browse all CWE-603 vulnerabilities →