Is CVE-2026-26264 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-26264, but active exploitation has not been confirmed.

Can CVE-2026-26264 be exploited remotely?

Yes. CVE-2026-26264 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26264?

CVE-2026-26264 has a CVSS score of 8.1 (HIGH) and an EPSS exploitation probability of 0.05%.

HOME VULNERABILITIESCVE-2026-26264

HIGHPOC

CVE-2026-26264

CWE-125Published: February 13, 2026· Updated: Feb 18, 2026

8.1

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.4th

Official Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.

NVD Source

Technical Analysis

CVE-2026-26264 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), availability disruption (denial of service), with a CVSS base score of 8.1.

A proof-of-concept (PoC) exploit exists for CVE-2026-26264. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.