Is CVE-2026-5479 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-5479, but active exploitation has not been confirmed.

Can CVE-2026-5479 be exploited remotely?

Partially. CVE-2026-5479 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-5479?

CVE-2026-5479 has a CVSS score of 7.6 (HIGH).

HOME VULNERABILITIESCVE-2026-5479

HIGHPOC

CVE-2026-5479

CWE-354Published: April 10, 2026· Updated: Apr 13, 2026

7.6

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.5th

Official Description

In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption, the implementation computes or accepts the tag but does not compare it against the expected value.

NVD Source

Technical Analysis

CVE-2026-5479 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A proof-of-concept (PoC) exploit exists for CVE-2026-5479. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X