Is CVE-2026-6458 actively exploited?

No active exploitation of CVE-2026-6458 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-6458 be exploited remotely?

Partially. CVE-2026-6458 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-6458?

CVE-2026-6458 has a CVSS score of 5.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-6458

MEDIUM

CVE-2026-6458

CWE-325Published: June 24, 2026· Updated: Jun 25, 2026

5.1

CVSS v3.1

EPSS:0.13%probability of exploitation in 30 daysPercentile:2.8th

Official Description

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change.

This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.

NVD Source

Technical Analysis

CVE-2026-6458 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X