CVE-2026-9266

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.

• CWE-325

• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-266240-cve-2026-9266-missing-required-cryptographic-step-vulnerability-in-industrial-computers

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9260Use of hard-coded cryptographic keys in Canon EOS Network Se…9.8
• CVE-2026-9261Use of weak SSH cryptographic algorithms in Canon EOS Networ…9.8
• CVE-2026-9262Use of a non-secure protocol as the default FTP configuratio…7.5
• CVE-2026-9263The Zephyr Bluetooth controller ISO Adaptation Layer (subsys…8.1
• CVE-2026-9264A cross-site scripting (XSS) vulnerability in SketchUp 2026'…9.3
• CVE-2026-9265Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits…9.1
• CVE-2026-9267Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f…6.9
• CVE-2026-9269The Secure Copy Content Protection and Content Locking WordP…3.5
• CVE-2026-9270DataDog::DogStatsd versions through 0.07 for Perl allow metr…9.1
• CVE-2026-9271Vulnerability Title5.9
• CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
• CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3