CVE-2023-26463

strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.

• CWE-295
• CWE-476
• CWE-295
• CWE-476

• https://github.com/strongswan/strongswan/releasesRelease Notes
• https://security.netapp.com/advisory/ntap-20230517-0010/
• https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-26463%29.htmlMitigation, Vendor Advisory
• https://github.com/strongswan/strongswan/releasesRelease Notes
• https://security.netapp.com/advisory/ntap-20230517-0010/
• https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-26463%29.htmlMitigation, Vendor Advisory

Published

Apr 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26458An information disclosure vulnerability exists in SAP Landsc…8.7
• CVE-2023-26459Due to improper input controls In SAP NetWeaver AS for ABAP …7.4
• CVE-2023-2646A vulnerability has been found in TP-Link Archer C7v2 v2_en_…4.5
• CVE-2023-26460Cache Management Service in SAP NetWeaver Application Server…5.3
• CVE-2023-26461SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50,…4.9
• CVE-2023-26462ThingsBoard 3.4.1 could allow a remote attacker to gain elev…8.1
• CVE-2023-26464** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or …7.5
• CVE-2023-26465Pega Platform versions 7.2 to 8.8.1 are affected by an XSS i…6.1
• CVE-2023-26466A user with non-Admin access can change a configuration file…7.8
• CVE-2023-26467A man in the middle can redirect traffic to a malicious serv…5.4
• CVE-2023-26468Cerebrate 1.12 does not properly consider organisation_id du…9.1
• CVE-2023-26469In Jorani 1.0.0, an attacker could leverage path traversal t…9.8