CVE intelligence

CVE-2026-5358

Vulnerability intelligence

Published Apr 20, 2026Sources checked Nov 8, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-5358. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Sep 9, 2026

See the Microsoft Security Update Guide for the update that applies to your product.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.0%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-5358?

Rejected reason: REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been discovered that no NIS+ client or server was ever released for any Linux-based OS distributions and as such this makes the API provisional and unused.

Secondly it has been discovered that the NIS+ cold start cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API can only be called with a trusted server from the pre-populated cache. The use of a trusted server means no trust boundary is crossed and this is therefore considered a normal bug.

Source: NVD