CVE-2026-9266
CVE-2026-9266 is a high-severity vulnerability with a CVSS 4.0 base score of 7.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-325.
Key facts
- Severity: High (CVSS 4.0 base score 7.0)
- EPSS exploit prediction: 0% (1st percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-36411
- Weakness: CWE-325
- Published:
- Last modified:
Description
A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.
Frequently asked questions
- What is CVE-2026-9266?
- A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.
- How severe is CVE-2026-9266?
- CVE-2026-9266 has a CVSS 4.0 base score of 7.0, rated high severity.
- Is CVE-2026-9266 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-9266?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-9266 have an EU (EUVD) identifier?
- Yes. CVE-2026-9266 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-36411.
- When was CVE-2026-9266 published?
- CVE-2026-9266 was published on 2026-06-12 and last updated on 2026-06-17.
References
Other CWE-325 vulnerabilities
- CVE-2026-4601 — High (CVSS 8.7): Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
- CVE-2025-30147 — High (CVSS 8.7): Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum…
- CVE-2026-45445 — High (CVSS 7.5): Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the…
- CVE-2026-41395 — High (CVSS 7.5): OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes…
- CVE-2026-22863 — High (CVSS 7.5): Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The…
- CVE-2025-60704 — High (CVSS 7.5): Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.