CVE-2026-74557 (GCVE-0-2026-74557)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-19 16:38
VLAI
Title
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 812f1ae95b22419422972748f173b0916ee4d621 (git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < fef6167e8149896cd81bea333fd51b1c91239149 (git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < baa04572673125e4d5bc309b4077d1cb46cc78d1 (git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 7567f06abdefb1caf2d836107c4d08c5185c650e (git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 60499924faf4ef97e84228c20515218ef121facf (git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 3ef209ca0b4b68c75e9a814d90cc916026b5a6ac (git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 1f07a897d43c63e6c9458bf77450defef39b5833 (git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 98b87885de4b7f605533a2860685f5689fce8e82 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.18
Unaffected: 0 , < 2.6.18 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "812f1ae95b22419422972748f173b0916ee4d621",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "fef6167e8149896cd81bea333fd51b1c91239149",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "baa04572673125e4d5bc309b4077d1cb46cc78d1",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "7567f06abdefb1caf2d836107c4d08c5185c650e",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "60499924faf4ef97e84228c20515218ef121facf",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "3ef209ca0b4b68c75e9a814d90cc916026b5a6ac",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "1f07a897d43c63e6c9458bf77450defef39b5833",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "98b87885de4b7f605533a2860685f5689fce8e82",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Fix stale-data leak into the SCSI sense buffer\n\niscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the\ntarget-supplied data segment.  The segment carries a 2-byte sense length\nfollowed by the sense bytes, so it must hold 2 + senselen bytes, but the\nbounds check only requires datalen \u003e= senselen:\n\n\tsenselen = get_unaligned_be16(data);\n\tif (datalen \u003c senselen)\n\t\tgoto invalid_datalen;\n\tmemcpy(sc-\u003esense_buffer, data + 2,\n\t       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));\n\nA target that returns a SCSI Response whose datalen equals senselen\n(with senselen \u003c= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +\n2 read up to two bytes past the received data.  Those bytes are stale\nconn-\u003edata contents and end up in the command\u0027s sense buffer, which is\nreturned to userspace.\n\nAccount for the 2-byte sense length prefix in the check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote malicious or compromised iSCSI target can trigger the bug by sending a crafted SCSI Command Response over the standard iSCSI/TCP session to a Linux kernel initiator, with no local access required on the victim host.\nAC:L - The attacker fully controls the response PDU fields (datalen, sense length, CHECK_CONDITION status) and can reliably set datalen equal to senselen so the flawed bounds check passes and stale conn-\u003edata bytes are copied into the sense buffer.\nPR:N - Exploitation requires only the ability to act as the iSCSI target on the network; the attacker needs no local account, capabilities, or privileges on the victim system initiating the connection.\nUI:N - Once an iSCSI session exists, the leak is triggered automatically on SCSI command responses with no further victim action; the attacker does not rely on a user opening a file, clicking a link, or performing any interactive step at exploit time.\nS:U - The flaw discloses kernel memory contents into a SCSI sense buffer returned within the same host security domain; it does not cross VM, hypervisor, or IOMMU boundaries and is a standard kernel-to-userspace information leak.\nC:H - The out-of-bounds memcpy reads up to two bytes per response from stale conn-\u003edata kernel heap memory into sc-\u003esense_buffer, which is copied to userspace via SCSI completion, ioctl, and BSG paths, enabling repeated kernel information disclosure.\nI:N - The vulnerability is a read-only out-of-bounds memcpy from the receive buffer into the sense buffer; it does not corrupt kernel structures, overwrite memory, or provide a write or code-execution primitive.\nA:N - The bug causes no kernel panic, oops, or hang; invalid responses are handled gracefully and exploitation only leaks data into the sense buffer without disrupting system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:59.951Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/812f1ae95b22419422972748f173b0916ee4d621"
        },
        {
          "url": "https://git.kernel.org/stable/c/fef6167e8149896cd81bea333fd51b1c91239149"
        },
        {
          "url": "https://git.kernel.org/stable/c/baa04572673125e4d5bc309b4077d1cb46cc78d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7567f06abdefb1caf2d836107c4d08c5185c650e"
        },
        {
          "url": "https://git.kernel.org/stable/c/60499924faf4ef97e84228c20515218ef121facf"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ef209ca0b4b68c75e9a814d90cc916026b5a6ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f07a897d43c63e6c9458bf77450defef39b5833"
        },
        {
          "url": "https://git.kernel.org/stable/c/98b87885de4b7f605533a2860685f5689fce8e82"
        }
      ],
      "title": "scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74557",
    "datePublished": "2026-08-15T12:28:01.988Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-08-19T16:38:59.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74557",
      "date": "2026-09-22",
      "epss": "0.00329",
      "percentile": "0.26287"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:54:28.000Z",
      "cve": "CVE-2026-74557",
      "id": "msrc_CVE-2026-74557",
      "initial_release_date": "2026-08-23T14:54:39.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74557.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/libiscsi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "812f1ae95b22419422972748f173b0916ee4d621",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fef6167e8149896cd81bea333fd51b1c91239149",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "baa04572673125e4d5bc309b4077d1cb46cc78d1",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7567f06abdefb1caf2d836107c4d08c5185c650e",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "60499924faf4ef97e84228c20515218ef121facf",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ef209ca0b4b68c75e9a814d90cc916026b5a6ac",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1f07a897d43c63e6c9458bf77450defef39b5833",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98b87885de4b7f605533a2860685f5689fce8e82",
                    "status": "affected",
                    "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/libiscsi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.18"
                  },
                  {
                    "lessThan": "2.6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Fix stale-data leak into the SCSI sense buffer\n\niscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the\ntarget-supplied data segment.  The segment carries a 2-byte sense length\nfollowed by the sense bytes, so it must hold 2 + senselen bytes, but the\nbounds check only requires datalen \u003e= senselen:\n\n\tsenselen = get_unaligned_be16(data);\n\tif (datalen \u003c senselen)\n\t\tgoto invalid_datalen;\n\tmemcpy(sc-\u003esense_buffer, data + 2,\n\t       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));\n\nA target that returns a SCSI Response whose datalen equals senselen\n(with senselen \u003c= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +\n2 read up to two bytes past the received data.  Those bytes are stale\nconn-\u003edata contents and end up in the command\u0027s sense buffer, which is\nreturned to userspace.\n\nAccount for the 2-byte sense length prefix in the check."
          }
        ],
        "id": "CVE-2026-74557",
        "lastModified": "2026-08-19T17:21:10.927",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:18:01.160",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1f07a897d43c63e6c9458bf77450defef39b5833"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ef209ca0b4b68c75e9a814d90cc916026b5a6ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/60499924faf4ef97e84228c20515218ef121facf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7567f06abdefb1caf2d836107c4d08c5185c650e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/812f1ae95b22419422972748f173b0916ee4d621"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/98b87885de4b7f605533a2860685f5689fce8e82"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/baa04572673125e4d5bc309b4077d1cb46cc78d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fef6167e8149896cd81bea333fd51b1c91239149"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-26T18:52:31+00:00",
      "cve": "CVE-2026-74557",
      "id": "CVE-2026-74557",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74557.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-23T00:17:30Z",
      "cve": "CVE-2026-74557",
      "id": "CVE-2026-74557",
      "initial_release_date": "2026-08-15T23:50:18Z",
      "product_status:first_fixed": "68",
      "product_status:known_affected": "702",
      "product_status:recommended": "23",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74557",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74557.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.