strongSwan CVE-2026-78130

Exploitation requires network reachability to a strongSwan IKE endpoint - typically UDP port 500 (ISAKMP) or UDP port 4500 (NAT-T) - running strongSwan version 4.2.0 or newer. The crash is triggered during X.509 attribute certificate verification, which occurs as part of normal IKE certificate exchange before authentication completes; no prior credentials or session are required. Limiting factors: the attacker must be able to reach the IKE service port (often filtered at perimeter firewalls for site-to-site VPN or restricted to roadwarrior IP pools); exploitation requires strongSwan to actually process the attribute certificate, implying the x509 plugin is loaded (the default configuration). Deployments with strict IP allowlisting on IKE ports face significantly reduced exposure.

The CVSS 7.5 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly captures the core risk: unauthenticated remote exploitation with full availability impact against the VPN daemon, requiring no complexity or interaction. No KEV listing and no public exploit code have been identified, and no EPSS score was provided in the input data. The impact is constrained to availability - there is no confidentiality or integrity exposure. However, VPN gateways are typically internet-facing perimeter infrastructure, meaning the attack surface is inherently broad; even a mid-sized municipal IT team in radom operating strongSwan-based IPsec tunnels should treat this as urgent patching work given the gateway's role in business continuity. The simultaneous disclosure of six strongSwan CVEs in one batch suggests a systematic security audit, lending credibility to the technical findings. The low exploitation complexity (AC:L, no privileges, no user interaction) means that once a triggering payload is constructed - a straightforward task given the well-understood IKE certificate exchange protocol - automated scanning could be feasible.

An attacker with network access to a strongSwan VPN gateway sends an IKE_SA_INIT or subsequent IKE exchange presenting a crafted X.509 attribute certificate. The x509 plugin's certificate verification routine dereferences a NULL pointer, immediately crashing the charon daemon and dropping all active VPN sessions and preventing new ones from establishing. No exploit code has been identified, but the straightforward AV:N/AC:L/PR:N/UI:N vector suggests low barrier once the malformed certificate structure is identified.