Which versions of Jetkvm are affected by CVE-2026-32295?

JetKVM installations are vulnerable to brute-force credential attacks due to missing login rate limiting, potentially allowing unauthorized access to critical infrastructure management interfaces.. A patch is available.

How to fix or mitigate CVE-2026-32295?

Within 24 hours: Identify all JetKVM instances in use and verify current version numbers; notify relevant teams of the vulnerability. Within 7 days: Apply vendor patch to upgrade JetKVM to version 0.5.4 or later across all affected systems. Within 30 days: Conduct access logs review for suspicious login attempts and reset credentials for all JetKVM administrative accounts as a precautionary measure.

Jetkvm CVE-2026-32295

Q: What is the CVSS score of CVE-2026-32295?

CVE-2026-32295 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12608 CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-17 cisa-cg

Information Disclosure Jetkvm

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12608

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

Patch released

Mar 17, 2026 - 20:30 nvd

Patch available

CVE Published

Mar 17, 2026 - 17:19 nvd

CRITICAL 9.3

DescriptionCVE.org

JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials.

AnalysisAI

JetKVM versions prior to 0.5.4 contain an authentication vulnerability that allows unlimited login attempts without rate limiting, enabling attackers to conduct brute-force attacks against user credentials. This affects KVM (Keyboard, Video, Mouse) over IP devices used for remote server management, potentially granting attackers administrative access to critical infrastructure. The vulnerability has been reported by CISA-CG and analyzed by security researchers at Eclypsium in their research on KVM device security risks.

Technical ContextAI

JetKVM is a KVM-over-IP solution that provides remote access to servers and infrastructure through network-connected hardware devices. The affected component is cpe:2.3:a:jetkvm:jetkvm, specifically the authentication mechanism in versions before 0.5.4. This vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts), meaning the application fails to implement controls that prevent or throttle repeated login attempts. KVM devices are particularly sensitive as they provide direct console access equivalent to physical presence at a server, including BIOS/UEFI access and pre-boot environments. The absence of rate limiting on the login interface creates a fundamental authentication weakness that undermines the security model of these critical access control devices.

RemediationAI

Upgrade JetKVM to version 0.5.4 or later immediately, as documented in the vendor release at https://github.com/jetkvm/kvm/releases/tag/release%2F0.5.4. Organizations should prioritize this update for any JetKVM devices exposed to untrusted networks or the internet. As an interim mitigation until patching is completed, restrict network access to JetKVM devices to trusted IP ranges using firewall rules or network segmentation, implement VPN-only access for remote management, and monitor authentication logs for signs of brute-force attempts (multiple failed login attempts from single sources). Consider implementing an external authentication proxy or reverse proxy with rate limiting capabilities in front of the device if immediate patching is not feasible. Given the critical nature of KVM device access, audit all JetKVM instances to ensure they are not directly exposed to the internet and verify strong credential policies are in place. Review the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json for additional guidance.