Which versions of Keysight IxChariot are affected by CVE-2026-49435?

Keysight IxChariot Endpoint and related network-test products (Hawkeye, IxTap, IxProbe, IxBypass) contain a critical remote code execution vulnerability enabling unauthenticated attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-49435?

Within 24 hours, identify all systems running Keysight IxChariot Endpoint, Hawkeye, IxTap, IxProbe, or IxBypass and document their network exposure; assess whether production dependencies allow temporary shutdown or air-gapping of vulnerable systems. Within 7 days, restrict network access via firewall rules and VLAN segmentation to limit connectivity to these systems to authorized test personnel and networks only; disable or isolate the systems if they are not actively required for current test operations; configure enhanced monitoring and alerting to detect exploitation attempts targeting these assets. Within 30 days, monitor Keysight security advisories and vendor channels continuously for patch release and availability; evaluate alternative network testing solutions to reduce long-term operational dependency on this vulnerable product line.

Keysight IxChariot CVE-2026-49435

Q: What is the CVSS score of CVE-2026-49435?

CVE-2026-49435 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-52870 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-08-04 cisa-cg

GHSA-98pg-jf9w-9qqg

RCE Buffer Overflow Stack Overflow Hawkeye Ixchariot Ixtap Ixprobe Ixbypass Keysight

9.3

CVSS 4.0 · Vendor: cisa-cg

Severity by source

Vendor (cisa-cg) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable crafted packet with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding admin-level code execution, so full C/I/A impact; scope unchanged as impact stays within the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 04, 2026 - 20:01 EUVD

Analysis Updated

Aug 04, 2026 - 19:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 19:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Aug 04, 2026 - 19:21 vuln.today

CVE Published

Aug 04, 2026 - 18:52 cve.org

CRITICAL 9.8

DescriptionCVE.org

Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.

AnalysisAI

Remote code execution in Keysight IxChariot Endpoint and related Keysight network-test products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single specially crafted packet. The flaw is a classic stack-based buffer overflow reachable over the network with no user interaction (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the trivial attack complexity and lack of any authentication make it a high-priority patch for any environment running these test tools.

Technical ContextAI

The affected products are Keysight's performance/network-testing suite: IxChariot generates and measures traffic between distributed Endpoints, while Hawkeye, IxTap, IxProbe and IxBypass provide network assessment, tap, probe and bypass functionality. The vulnerability is CWE-121 (Stack-Based Buffer Overflow): a network-facing parser copies attacker-controlled packet data into a fixed-size stack buffer without adequate bounds checking, overwriting the saved return address and adjacent stack frame. Because the vulnerable Endpoint/agent listens for measurement traffic on the network and typically runs with elevated (administrative) rights, a successful overflow yields immediate high-privilege code execution rather than a mere crash.

RemediationAI

Patch available per vendor advisory: consult the Keysight IxChariot security advisory (https://www.keysight.com/us/en/about/quality-and-security/security/product-and-solution-cyber-security/security-advisory-archive/security-advisory--ixchariot-vulnerability.html) and the CISA CSAF advisory va-26-216-01 (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-216-01.json) for the fixed release for each affected product (IxChariot, Hawkeye, IxTap, IxProbe, IxBypass) and upgrade to it - exact fix versions were not included in the analyzed data and must be taken from the vendor advisory rather than assumed. Until patched, restrict network reachability of the IxChariot Endpoint/agent and other Keysight test components: place them on an isolated management/test VLAN, and use host or network firewall rules to allow the measurement/control ports only from known IxChariot Console/controller hosts (this blocks the crafted-packet path but will break any distributed tests that rely on broad Endpoint reachability). Where a component is not in active use, stop or disable the listening service to remove the attack surface entirely, accepting that scheduled or on-demand tests using that Endpoint will fail until it is re-enabled and patched.