CVE-2026-78135 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
mitre	CNA	5.6 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 26.63%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
strongswan	strongswan	5.9.7 ≤ 𝑥 < 6.1.0	CNA

Debian Releases

Debian Product

Codename

strongswan

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	6.1.0-2 fixed
trixie	vulnerable
trixie (security)	6.0.1-6+deb13u7 fixed

Ubuntu Releases

Ubuntu Product

Codename

strongswan

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
trusty	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

strongswan

suse enterprise desktop 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise sap 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise server 15 SP7	5.9.14-150700.3.21.2 fixed

strongswan-doc

suse enterprise desktop 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise sap 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise server 15 SP7	5.9.14-150700.3.21.2 fixed

strongswan-hmac

suse enterprise desktop 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise sap 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise server 15 SP7	5.9.14-150700.3.21.2 fixed

strongswan-ipsec

suse enterprise desktop 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise sap 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise server 15 SP7	5.9.14-150700.3.21.2 fixed

strongswan-libs0

suse enterprise desktop 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise sap 15 SP7	5.9.14-150700.3.21.2 fixed
suse enterprise server 15 SP7	5.9.14-150700.3.21.2 fixed

Common Weakness Enumeration

CWE-841 - Improper Enforcement of Behavioral Workflow
The software supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Vulnerability Media Exposure

[GERMAN] strongSwan: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in strongSwan ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen, Informationen offenzulegen und Code auszuführen.
Published: 2026-09-07T22:00:00+00:00

References

https://github.com/strongswan/strongswan/releases/tag/6.1.0

https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html