Vulnerability Details CVE-2026-78135
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 26.9%
CVSS Severity
CVSS v3 Score 5.6
References
Products affected by CVE-2026-78135
-
cpe:2.3:a:strongswan:strongswan:5.9.10
-
cpe:2.3:a:strongswan:strongswan:5.9.11
-
cpe:2.3:a:strongswan:strongswan:5.9.12
-
cpe:2.3:a:strongswan:strongswan:5.9.7
-
cpe:2.3:a:strongswan:strongswan:5.9.8
-
cpe:2.3:a:strongswan:strongswan:5.9.9
-
cpe:2.3:a:strongswan:strongswan:6.0