CVE-2026-49435

Description

Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.

Overview

State: PUBLISHED
Assigner (CNA): cisa-cg
CVSS severity: CRITICAL
CVSS score: 9.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 9.3 / 10 CRITICAL source: CNA overview
CWE(s): CWE-121
Reserved: 2026-05-29
Published: 2026-08-04 18:52 UTC
Last updated: 2026-08-04 18:59 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49435.json
Linked Threat: CVE-2026-49435 — Keysight IxChariot-related products stack-based buffer overflow

Affected products (5)

Vendor	Product	Versions	Platforms
Keysight	Hawkeye	`0` (affected), `6.0.7` (unaffected)	—
Keysight	IxChariot	`10.0.254` (unaffected), `0` (affected)	—
Keysight	IxTap	`0` (affected), `3.13.0` (unaffected)	—
Keysight	IxProbe	`0` (affected), `3.13.0` (unaffected)	—
Keysight	IxByPass	`0` (affected), `3.13.0.69` (unaffected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

url release-notes
url release-notes
url release-notes
url release-notes
url release-notes
url third-party-advisory
url vdb-entry

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-49435.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49435",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T18:59:31.599509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T18:59:37.866Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Hawkeye",
          "vendor": "Keysight",
          "versions": [
            {
              "lessThan": "6.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "6.0.7"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "IxChariot",
          "vendor": "Keysight",
          "versions": [
            {
              "status": "unaffected",
              "version": "10.0.254"
            },
            {
              "lessThan": "10.0.254",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "IxTap",
          "vendor": "Keysight",
          "versions": [
            {
              "lessThan": "3.13.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "3.13.0"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "IxProbe",
          "vendor": "Keysight",
          "versions": [
            {
              "lessThan": "3.13.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "3.13.0"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "IxByPass",
          "vendor": "Keysight",
          "versions": [
            {
              "lessThan": "3.13.0.69",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "3.13.0.69"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "S\u00e9bastien Charbonnier, ANSSI"
        }
      ],
      "datePublic": "2026-04-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-49435",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-05-29T17:58:14.676221Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T18:52:30.921Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://www.keysight.com/us/en/lib/software-detail/computer-software/hawkeye.html"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://www.keysight.com/us/en/about/quality-and-security/security/product-and-solution-cyber-security/security-advisory-archive/security-advisory--ixchariot-vulnerability.html"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://www.keysight.com/us/en/lib/software-detail/computer-software/ixchariot.html"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/ixprobe.html"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://www.keysight.com/us/en/product/IXTP-CU3-T/copper-taps---ixtp-cu3-t.html"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-216-01.json"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49435"
        }
      ],
      "title": "Keysight IxChariot-related products stack-based buffer overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-49435",
    "datePublished": "2026-08-04T18:52:30.921Z",
    "dateReserved": "2026-05-29T21:56:48.486Z",
    "dateUpdated": "2026-08-04T18:59:37.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}