CVE-2026-86326

{
  "etk_id": "ETK-2026-331",
  "cve_id": "CVE-2026-86326",
  "display_id": "CVE-2026-86326",
  "ghsa_id": "GHSA-pccp-468g-6mp8",
  "euvd_id": "EUVD-2026-91373",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Firmware signature validation flaw in MGate MB3170 and MB3270",
  "summary": "MGate MB3170 and MB3270 protocol gateways inadequately validate firmware-image signatures during updates. An attacker who already has elevated privileges and can use the firmware update interface may install altered firmware, enabling unauthorized code execution and persistent device modification.",
  "mitigation": "Restrict firmware update and management access to trusted administrators and tightly controlled networks, and monitor firmware update activity. Obtain and apply vendor guidance or updates when released; no fixed version is recorded for either affected series.",
  "vendor": "Moxa",
  "product": "MGate MB3170 Series",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "MGate MB3170 Series",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "MGate MB3270 Series",
      "purl": null
    }
  ],
  "cwes": [
    347
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0796,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.534446616666667,
  "t0_at": "2026-10-02T10:21:56.863000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T10:21:56.863000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T10:21:56.863000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86326"
    }
  }
}