SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-47895

HIGH · CVSS 7.5 EPSS 0.67% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

In strongSwan versions prior to 6.0.7, a vulnerability exists in the handling of identity parsing and cloning, leading to improper management of EAP-Identities that can result in a double-free condition. This flaw could be exploited to cause application crashes or potentially execute arbitrary code, making it critical for organizations using strongSwan for VPN services to prioritize updates. Users of affected versions should urgently assess their systems and apply the necessary patches to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-47895
Severity
HIGH
CVSS
7.5
EPSS
0.67%

Original NVD Description

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.