CVE-2026-45787

Description

electerm's encrypt method not safe enough

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-45787 on 2026-07-06. Shown when MITRE's text differs from the cvelistV5 mirror.

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.

Overview

State

—

Assigner (CNA)

—

CVSS severity

critical

CVSS score

9.8 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Effective score

9.8 / 10 CRITICAL source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-45787

Linked Threat

CVE-2026-45787 — CVE-2026-45787

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-32959

Assigner

GitHub_M

Published

May 28, 2026, 5:17:56 PM

Updated

May 29, 2026, 3:29:15 PM

EUVD base score (CVSS 4.0)

6.0 / 10
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EUVD-reported EPSS

0.1100

Vendors

electerm

Products

electerm (< 3.9.5)

Aliases

GHSA-g29v-q6h7-76wh

ENISA description: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937 tenable:github.com
• https://github.com/electerm/electerm/security/advisories/GHSA-g29v-q6h7-76wh tenable:github.com
• https://www.first.org/epss/ tenable:www.first.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-45787 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45787 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Oracle Critical Patch Update, April 2026 Security Update Review
  web:blog.qualys.com

  Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.

  2026-05-26 02:54 UTC
• Oracle Releases Critical Security Patch Fixing 337 Vulnerabilities ...
  web:cyberpress.org

  Oracle has released its January 2026 Critical Patch Update (CPU), delivering security patches for 337 vulnerabilities across multiple product families. Published through Oracle's Security Alerts portal, the advisory emphasizes the cumulative nature of these patches and strongly recommends immediate deployment across enterprise environments to ...

  2026-05-26 02:54 UTC
• April 2026 Patch Tuesday | Critical Patches & Deployment Guide
  web:layerlogix.com

  April 2026 Patch Tuesday drops today. Here's what's critical, what to patch first, and how Houston IT teams should handle deployment — including the Secure Boot certificate deadline reminder.

  2026-05-26 02:54 UTC
• Nvd - Cve-2026-5787
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-05-26 02:54 UTC
• Addressing Exchange Server May 2026 vulnerability CVE-2026-42897
  web:techcommunity.microsoft.com

  We wanted to tell you how to address the Exchange Server May 2026 vulnerability CVE - 2026 -42897.

  2026-05-26 02:54 UTC
• Exchange Server 2016 And 2019 Hit By Critical OWA Vulnerability
  web:windowsreport.com

  Microsoft warned Exchange Server customers about critical OWA vulnerability CVE - 2026 -42897 affecting on-premises deployments.

  2026-05-26 02:54 UTC
• Microsoft Confirms Active 0-Day Exploit—Check Emergency Mitigation
  web:www.forbes.com

  Updated May 17: This article, originally published May 16, has been updated to include further details on the emergency mitigation process recommended after the CVE - 2026 -42897 Microsoft Exchange ...

  2026-05-26 02:54 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-05-26 02:54 UTC
• Oracle Patches 450 Vulnerabilities With April 2026 CPU
  web:www.securityweek.com

  Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.

  2026-05-26 02:54 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-26 02:54 UTC

Only Available for Registered Users. Sign in to view.