Dashboard / CVE-2026-6986

CVE-2026-6986

LOW
INFO Priority: 0.01 BB Relevance: 66/100
Published: 2026-04-25 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: X
AT: None
VC: None
VI: Low
VA: None

Description

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
cesanta mongoose 7.0 – 7.21

References & Advisories (5)

https://vuldb.com/submit/796231
Third Party Advisory VDB Entry
https://vuldb.com/vuln/359529
Third Party Advisory VDB Entry
https://vuldb.com/vuln/359529/cti
Permissions Required VDB Entry

Bug Bounty Relevance

66 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

2.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.22%
Raw Score 0.002170
Percentile 12.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00217
2026-10-28
0.00217

Intelligence Sources

nvd ref →

External Links