Is CVE-2026-32953 actively exploited?

No active exploitation of CVE-2026-32953 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32953 be exploited remotely?

No. CVE-2026-32953 requires physical access to exploit.

What is the CVSS score of CVE-2026-32953?

CVE-2026-32953 has a CVSS score of 4.7 (MEDIUM).

HOME VULNERABILITIESCVE-2026-32953

MEDIUM

CVE-2026-32953

CWE-303Published: March 20, 2026· Updated: Mar 20, 2026

4.7

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.3th

Official Description

Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.

NVD Source

Technical Analysis

CVE-2026-32953 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorPhysical

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X