Improper validation of integrity check value in NetX Duo - CVE-2026-102759
Published: November 9, 2026
Vulnerability identifier: #VU162961
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102759
CWE-ID: CWE-354
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated network attacker to disrupt established TLS connections, causing denial of service.
The vulnerability exists due to NetX Secure TLS skipping message authentication code verification for empty application records when negotiating TLS 1.2 or earlier with separate record MACs. An unauthenticated network attacker can modify or replay ciphertext on an established session to have an altered empty record accepted and advance the receiver's sequence state.
Affected software
NetX Duo
How to mitigate CVE-2026-102759
Install security update from vendor's website.
NetX Duo - update to 6.5.2.202603