CVE-2026-86326

CVE-2026-86326 is an improper cryptographic-signature verification flaw (CWE-347) in Moxa protocol gateways. The devices do not properly check that a firmware image is authentic before installing it, so an attacker who already has high privileges and access to the firmware update interface can supply a crafted or modified image that the gateway will install. Successful exploitation can run unauthorized code, damage the device’s integrity and availability, and keep malicious changes in place across later firmware updates. Impact is confined to operators of the affected Moxa protocol gateways; the advisory data does not name models or version ranges. It is not on the CISA KEV list, and no public proof-of-concept is known.

What to do: Treat this as a privileged firmware-integrity flaw: limit who can reach the firmware update interface, accept only vendor-signed images, and apply Moxa’s fix as soon as a patched release is published for your gateway model. Until then, segment protocol gateways from general networks and review update logs for unexpected firmware installs.