CVE-2026-76685
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful exploitation could result in a buffer overflow, potentially leading to remote code execution or denial-of-service.
Risk Assessment
The vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service, posing a serious threat to confidentiality, integrity, and availability.
Recommendation
Immediately install vendor patches for the affected component and consider network segmentation and traffic filtering to proxy services.
Related vulnerabilities
- CVE-2026-93866Critical
An integer overflow vulnerability exists in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal. A remote, unauthenticated attacker can write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.
- CVE-2026-93865Critical
A missing authentication vulnerability exists in the Fireware OS FireCluster synchronization daemon. A remote, unauthenticated attacker can invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
- CVE-2026-93857Critical
A stack-based buffer overflow vulnerability exists in Fireware OS's SIP proxy. A remote, unauthenticated attacker can execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
- CVE-2026-90465Critical
A missing authentication vulnerability exists in FireCluster Sync processing. An attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can invoke privileged firewall management actions as root by sending a specially crafted request.
- CVE-2026-116863Critical
A Cross-Site Request Forgery (CSRF) vulnerability exists in Tribulant Software Newsletters (newsletters-lite). This issue affects Newsletters from n/a through 4.18.2.
- CVE-2026-112710Critical
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who controls or intercepts traffic to the configured Active Directory server can create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
- CVE-2026-112709Critical
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who controls or intercepts traffic to the configured Active Directory server can create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
- CVE-2026-103594Critical
A stack-based buffer overflow vulnerability exists in Fireware OS's WireGuard configuration processing. A remote attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud can create a denial of service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.
- CVE-2026-117564Critical
nest-admin before 1.0.1 contains an authentication bypass that lets unauthenticated attackers forge administrator tokens using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret trusted by JwtStrategy and RbacGuard, impersonating any user ID or claiming the admin role.
- CVE-2026-65145Critical
NVIDIA NeMo Agent Toolkit contains a missing authentication vulnerability that an attacker could exploit. This may lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure.
Original NVD description (English source)
A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful exploitation could result in a buffer overflow, potentially leading to remote code execution or denial-of-service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS