CVE-2026-32935 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 29%

Affected Products (NVD)

Vendor	Product	Version
phpseclib	phpseclib	𝑥 < 1.0.27
phpseclib	phpseclib	2.0.0 ≤ 𝑥 < 2.0.52
phpseclib	phpseclib	3.0.0 ≤ 𝑥 < 3.0.50

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

php-phpseclib

bookworm	2.0.42-1+deb12u5 fixed
bookworm (security)	2.0.42-1+deb12u3 fixed
bullseye	vulnerable
bullseye (security)	vulnerable
forky	2.0.55-1 fixed
sid	2.0.55-1 fixed
trixie	2.0.48-3+deb13u3 fixed
trixie (security)	2.0.48-3+deb13u1 fixed

php-phpseclib3

bookworm	3.0.19-1+deb12u6 fixed
bookworm (security)	3.0.19-1+deb12u4 fixed
forky	3.0.55-1 fixed
sid	3.0.55-1 fixed
trixie	3.0.43-2+deb13u3 fixed
trixie (security)	3.0.43-2+deb13u1 fixed

phpseclib

bookworm	1.0.20-1+deb12u5 fixed
bookworm (security)	1.0.20-1+deb12u3 fixed
bullseye	vulnerable
bullseye (security)	1.0.19-3+deb11u3 fixed
sid	1.0.30-1 fixed
trixie	1.0.23-6+deb13u3 fixed
trixie (security)	1.0.23-6+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

php-phpseclib

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	needs-triage
resolute	needs-triage
xenial	ignored

php-phpseclib3

jammy	needs-triage
noble	needs-triage
questing	needs-triage
resolute	needs-triage

phpseclib

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	needs-triage
resolute	needs-triage
xenial	ignored

Common Weakness Enumeration

CWE-208 - Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Vulnerability Media Exposure

[GERMAN] Cacti: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Cacti ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, um Dateien zu manipulieren, und um Informationen offenzulegen.
Published: 2026-06-15T22:00:00+00:00

References

https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788

https://github.com/phpseclib/phpseclib/security/advisories/GHSA-94g3-g5v7-q4jg