Vulnerabilities
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
What’s Wrong?
A flaw in StrongSwan’s packet handling logic lets an attacker send specially crafted IKE messages that cause the daemon to crash. The bug is triggered during the initial negotiation phase and does not require any authentication, making it exploitable from anywhere on the network.
Impact
Remote denial of service – the compromised host’s StrongSwan service stops responding, effectively disabling VPN connectivity for all users. In environments where StrongSwan is the sole VPN gateway, this can lead to a full network outage.
Affected Versions
- StrongSwan 6.0.x and earlier
- All releases prior to the 6.1.0 update
Mitigation
Apply the vendor‑issued security patch as soon as it becomes available. The patch corrects the malformed packet handling routine and restores stability. If a patch is not yet released, consider temporarily disabling the StrongSwan service or restricting inbound IKE traffic to trusted hosts.
More Info
"The issue was identified during routine security reviews and has been addressed in the latest StrongSwan release. Users are urged to update immediately to avoid service disruption." – StrongSwan Security Team
For detailed patch instructions, consult the official StrongSwan security bulletin and the CVE database entry for CVE‑2026‑78123.
Related vulnerabilities
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing
F5 NGINX Remote DoS & Data Integrity Flaw (CVE-2026-90439) – Patch Now
A critical flaw in F5’s NGINX Open Source has been exposed, letting attackers trigger a remote denial‑of‑service and corrupt data integrity. The vulnerability, identified as CVE‑2026‑90439, affects NGINX 1.31.x prior to 1.31.6 and 1.30.5. Immediate patching is essential. F5 has released a security bulletin detailing the fix; administrators should update or apply the vendor’s mitigation steps without delay.
Read briefing
Schneider Electric SCADAPack x70 RTU Vulnerability (CVE‑2026‑81861) – Urgent RBAC Migration Needed
Schneider Electric’s SCADAPack x70 series – including the 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 models – is affected by CVE‑2026‑81861. The flaw stems from insufficiently protected credentials that allow attackers to hijack the Secure Lock feature and gain unauthorized access to RTU configuration. The vulnerability carries a CVSS score of 6.5 and threatens critical manufacturing and energy infrastructures worldwide. Immediate remediation requires disabling legacy Secure Lock, enabling Role‑Based Access Control (RBAC), and applying standard hardening measures such as network segmentation and
Read briefing