CVE-2026-50722 - IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

Back Back to CVE browser

HIGH

IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

Published Jul 2, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.35%

Description

Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.

Affected products

Vendor The Libreswan Project Product Libreswan Default
unaffected
Affected
- ≥ 0, ≤ 5.3
Unaffected
- 5.3.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
The Libreswan Project	Libreswan	unaffected	Affected ≥ 0, ≤ 5.3 Unaffected 5.3.1

Fast Datapath for Red Hat Enterprise Linux 9

libreswan-0:5.3.2-1.el9fdp

Fixed · RHSA-2026:46986
Red Hat Enterprise Linux 10

libreswan-0:5.3.2-1.el10_2

Fixed · RHSA-2026:46398
Red Hat Enterprise Linux 10.0 Extended Update Support

libreswan-0:5.2-1.el10_0.5

Fixed · RHSA-2026:55449
Red Hat Enterprise Linux 8

libreswan-0:4.12-2.el8_10.6

Fixed · RHSA-2026:46396
Red Hat Enterprise Linux 9

libreswan-0:4.15-10.el9_8

Fixed · RHSA-2026:46397
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

libreswan-0:4.9-5.el9_2.5

Fixed · RHSA-2026:61779
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

libreswan-0:4.12-3.el9_4.2

Fixed · RHSA-2026:61258
Red Hat Enterprise Linux 9.6 Extended Update Support

libreswan-0:4.15-8.el9_6.1

Fixed · RHSA-2026:57741
Red Hat OpenShift Container Platform 4.19

rhcos-4.19.9.6.202609021231-0

Fixed · RHSA-2026:63044
Red Hat OpenShift Container Platform 4.20

rhcos-4.20.9.6.202609021029-0

Fixed · RHSA-2026:63100
Red Hat OpenShift Container Platform 4.21

rhcos-4.21.9.6.202609021100-0

Fixed · RHSA-2026:63041
Red Hat Enterprise Linux 6

libreswan

Out of support scope
Red Hat Enterprise Linux 7

libreswan

Affected
Red Hat OpenShift Container Platform 4

libreswan

Not affected

Product	Package	State	Advisory
Fast Datapath for Red Hat Enterprise Linux 9	libreswan-0:5.3.2-1.el9fdp	Fixed	RHSA-2026:46986
Red Hat Enterprise Linux 10	libreswan-0:5.3.2-1.el10_2	Fixed	RHSA-2026:46398
Red Hat Enterprise Linux 10.0 Extended Update Support	libreswan-0:5.2-1.el10_0.5	Fixed	RHSA-2026:55449
Red Hat Enterprise Linux 8	libreswan-0:4.12-2.el8_10.6	Fixed	RHSA-2026:46396
Red Hat Enterprise Linux 9	libreswan-0:4.15-10.el9_8	Fixed	RHSA-2026:46397
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	libreswan-0:4.9-5.el9_2.5	Fixed	RHSA-2026:61779
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	libreswan-0:4.12-3.el9_4.2	Fixed	RHSA-2026:61258
Red Hat Enterprise Linux 9.6 Extended Update Support	libreswan-0:4.15-8.el9_6.1	Fixed	RHSA-2026:57741
Red Hat OpenShift Container Platform 4.19	rhcos-4.19.9.6.202609021231-0	Fixed	RHSA-2026:63044
Red Hat OpenShift Container Platform 4.20	rhcos-4.20.9.6.202609021029-0	Fixed	RHSA-2026:63100
Red Hat OpenShift Container Platform 4.21	rhcos-4.21.9.6.202609021100-0	Fixed	RHSA-2026:63041
Red Hat Enterprise Linux 6	libreswan	Out of support scope	n/a
Red Hat Enterprise Linux 7	libreswan	Affected	n/a
Red Hat OpenShift Container Platform 4	libreswan	Not affected	n/a

Remediation

Vendor solution

Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/

Red Hat statement

Red Hat Product Security rates this as having an Moderate security impact. This Moderate severity rating reflects the deployment reality on modern enterprise platforms. The worst-case authentication bypass vector is effectively non-exploitable due to system-wide Crypto-Policies that strictly block the weak RSA exponents required for the attack. Furthermore, the resulting Denial of Service is limited to a controlled process abort via an internal assertion check. Because the Libreswan service is natively managed by systemd with automatic fault-recovery rules enabled by default, the daemon will instantly restart following a crash. Consequently, a sustained outage requires a continuous and high-volume malicious packet flood, significantly lowering the real-world operational risk.

Red Hat mitigation

If upgrading to Libreswan is not immediately feasible, this vulnerability can be mitigated by enforcing modern signature algorithms, which effectively prevents Libreswan from falling back to the vulnerable legacy parser logic. Explicitly configure your authby (or leftauth/rightauth) parameters in /etc/ipsec.conf to exclusively permit ECDSA and RSASSA-PSS: ```authby=ecdsa,rsa-sha2``` Note: Applying this mitigation will drop compatibility with native Windows VPN clients that do not support RSASSA-PSS.

Weaknesses (2)

CWE-347

CWE-617

References (10)

https://access.redhat.com/security/cve/CVE-2026-50722
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2494148
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41440
Advisory
https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt
relatedVendor AdvisoryMailing List
https://libreswan.org/security/CVE-2026-50722
patchVendor Advisory
https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt
vendor-advisoryVendor Advisory
https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/
https://nvd.nist.gov/vuln/detail/CVE-2026-50722
https://www.cve.org/CVERecord?id=CVE-2026-50722
https://www.rfc-editor.org/rfc/rfc8017
technical-descriptionTechnical Description

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-50722		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2494148		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41440		Advisory
https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt		relatedVendor AdvisoryMailing List
https://libreswan.org/security/CVE-2026-50722		patchVendor Advisory
https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt		vendor-advisoryVendor Advisory
https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/
https://nvd.nist.gov/vuln/detail/CVE-2026-50722
https://www.cve.org/CVERecord?id=CVE-2026-50722
https://www.rfc-editor.org/rfc/rfc8017		technical-descriptionTechnical Description

Change history (126)

Sep 23, 2026, 18:49 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 16:48 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 12:50 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 10:50 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 08:50 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 06:49 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 04:50 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 02:49 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 23, 2026, 00:49 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 22:49 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 20:50 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 17:29 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 15:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 13:29 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 11:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 09:29 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 07:38 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 05:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 03:30 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 22, 2026, 01:29 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 23:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 21:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 19:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 17:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 15:27 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 13:27 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 11:27 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 09:28 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 04:34 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 02:33 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 21, 2026, 00:36 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS score
  changed from 8.1 to 7.5
Sep 20, 2026, 22:44 UTC MITRE
- CVSS vector
  changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS score
  changed from 7.5 to 8.1

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner libreswan

Published Jul 2, 2026

Updated Jul 7, 2026

Reserved Jun 5, 2026

Link CVE-2026-50722

CISA Vulnrichment

Updated Jul 6, 2026

NVD

Status Analyzed

Modified Jul 9, 2026

Link CVE-2026-50722

Red Hat

Severity Moderate

Public date Jun 24, 2026

Bugzilla 2494148

Link CVE-2026-50722

ENISA EUVD

Assigner libreswan

Published Jul 2, 2026

Updated Jul 7, 2026

Link EUVD-2026-41440

GitHub

No data