CVE-2026-75945
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
CVSS
2.6
Bajo
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 14 sept 2026 · Última mod.: 15 sept 2026 · CWE-459
Sin historial EPSS suficiente todavía.
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-759442.6 BAJ—
———A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.11hCVE-2026-759432.6 BAJ—
———A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.12hCVE-2026-889325.3 MED—
——0multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.1dCVE-2026-877767.5 ALT29.7%
——9compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.4dCVE-2026-875496.5 MED25.2%
——8Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-874466.5 MED26.1%
——8Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)5d