Medium severity5.6NVD Advisory· Published Sep 11, 2026

CVE-2026-78135

Description

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.

Affected products

Strongswan/Strongswanreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 5.9.7 - 6.0.7

Patches

Vulnerability mechanics

References

github.com/strongswan/strongswan/releases/tag/6.1.0nvd
www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.364
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000