CVE-2026-9266

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.

• CWE-325

• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-266240-cve-2026-9266-missing-required-cryptographic-step-vulnerability-in-industrial-computers

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92626Control iD iDSecure versions prior to 4.8.3.0 are affected b…7.5
• CVE-2026-92627A heap-use-after-free vulnerability exists in H5T__conv_f_f(…4.6
• CVE-2026-92628GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-9263The Zephyr Bluetooth controller ISO Adaptation Layer (subsys…8.1
• CVE-2026-9264A cross-site scripting (XSS) vulnerability in SketchUp 2026'…9.3
• CVE-2026-9265Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits…9.1
• CVE-2026-9267Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f…6.9
• CVE-2026-92680Araxis Merge for Windows version 2011.4074 through 2026.0 st…5.5
• CVE-2026-9269The Secure Copy Content Protection and Content Locking WordP…3.5
• CVE-2026-92692Sulu is an open-source PHP content management system based o…6.9
• CVE-2026-9270DataDog::DogStatsd versions through 0.07 for Perl allow metr…9.1
• CVE-2026-92700Caddy is an extensible server platform that uses TLS by defa…6.3