CVE-2026-9033

MediumCVSS 4.3/10Last modified Sep 8, 2026

Description

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. 

Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2026
Last modified
Sep 8, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-90330In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidpp_ff_inCVE-2026-90331In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issuCVE-2026-903328.2In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSICVE-2026-90333In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector markCVE-2026-90334In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdev_add() failure tty_cdev_add() drops CVE-2026-90335In the Linux kernel, the following vulnerability has been resolved: tty: skip cdev_del() when no cdev is registered TTY device registratioCVE-2026-90336In the Linux kernel, the following vulnerability has been resolved: serial: core: clear freed pointers on uart_register_driver() failure uCVE-2026-90337In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registeCVE-2026-90338In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011CVE-2026-90339In the Linux kernel, the following vulnerability has been resolved: powerpc/syscall: Fix syscall skip handling for seccomp and ptrace AfteCVE-2026-90347.8Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU ArchitecCVE-2026-90340In the Linux kernel, the following vulnerability has been resolved: pinctrl: generic: free maps on pinctrl_generic_to_map() failure pinctr
CVE-2026-9033: Medium severity, CVSS 4.3 | Vulnix