CVE-2026-1626

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-162606.8The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings bCVE-2026-162617.5The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, aCVE-2026-162627.5The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowCVE-2026-162638.8The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a uCVE-2026-162646.5The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues CVE-2026-162656.5The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operatioCVE-2026-162664.0Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attackerCVE-2026-162678.1The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submiCVE-2026-162688.2The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied UCVE-2026-162694.8The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypCVE-2026-16278.1An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of tCVE-2026-162706.9Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When so
CVE-2026-1626: Critical severity, CVSS 9.1 | Vulnix