Is CVE-2026-26963 actively exploited?

No active exploitation of CVE-2026-26963 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26963 be exploited remotely?

Partially. CVE-2026-26963 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-26963?

CVE-2026-26963 has a CVSS score of 6.1 (MEDIUM) and an EPSS exploitation probability of 0.01%.

HOME VULNERABILITIESCVE-2026-26963

MEDIUM

CVE-2026-26963

CWE-863Published: February 20, 2026· Updated: Feb 20, 2026

6.1

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.6th

Official Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.

NVD Source

Technical Analysis

CVE-2026-26963 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.