CVE-2026-127123

P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU.

• CWE-404

• https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127109A code injection vulnerability in promzard’s template-loadin…
• CVE-2026-127111SOGo before 5.12.13 contains an improper restriction of exce…7.4
• CVE-2026-127119Unverified ownership of the default cluster log location in …5.3
• CVE-2026-127120A vulnerability was found in Governikus AusweisApp Mobile up…4.3
• CVE-2026-127121SOGo before 5.12.13 contains an improper cryptographic signa…6.5
• CVE-2026-127122P-Net before 1.0.4 does not check the number of MCR request …7.2
• CVE-2026-127124P-Net before 1.0.4 keeps the RPC session that is allocated f…7.1
• CVE-2026-127125P-Net before 1.0.4 aborts the Application Relationship of an…6
• CVE-2026-12713The WPCargo Track & Trace WordPress plugin before 8.0.4 does…9.1
• CVE-2026-127131SOGo before 5.12.13 contains a missing rate limiting vulnera…7.4
• CVE-2026-127135SOGo before 5.12.13 contains a Sieve script injection vulner…4.3
• CVE-2026-127141SOGo before 5.12.13 contains a denial of service vulnerabili…6.5