CVE intelligence

CVE-2026-14957

Vulnerability intelligence

Published Sep 2, 2026Sources checked Oct 28, 2026

7.5HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-14957 and is rated High severity with a CVSS score of 7.5. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Sep 19, 2026

See the Microsoft Security Update Guide for the update that applies to your product.

Vendor-listed releases

4.15-3

CISA KEVNot listedBased on the latest collected catalog

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-14957?

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0.

A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service.

No remote code execution is possible. Both IKEv1 and IKEv2 are affected.

The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this.

Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.

Source: NVD