strongSwan CVE-2026-78134

Exploitation requires: (1) the target strongSwan server must be configured to use a tunneled EAP authentication method (EAP-TTLS, EAP-PEAP, or equivalent) for IKEv2 - this is the critical configuration prerequisite reflected in AC:H; deployments using certificate-only mutual authentication, EAP-MSCHAPv2 without tunneling, or other non-tunneled methods are entirely outside the attack surface; (2) the attacker must be able to reach the IKEv2 server over the network to initiate a session; (3) the PR:L metric indicates the attacker needs at minimum a low-privilege context such as a recognized outer EAP identity to begin the inner exchange. Exploitation is bounded by the requirement for specific non-default EAP tunneling configuration, which reduces the population of vulnerable deployments relative to all strongSwan users.

The CVSS 7.1 score (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) conveys a meaningful real-world threat despite the high complexity qualifier: successful exploitation yields full VPN session access rather than partial information leakage, reflected by C:H/I:H. AC:H is the key limiting signal - it indicates that the server must be configured to use a tunneled EAP method, which is not the default or simplest deployment mode; environments using certificate mutual authentication or non-tunneled EAP are entirely outside the attack surface. PR:L implies the attacker requires a low-privilege foothold such as a valid outer EAP identity before the inner phase can be exploited. No EPSS score, CISA KEV listing, or public POC is present in the input data, so exploitation probability cannot be quantified, and there is no confirmed active exploitation. Given that VPN gateways are perimeter-critical infrastructure, even a mid-sized municipal IT team in olsztyn relying on strongSwan for remote access should treat this as urgent, because a successful bypass delivers network-level access to protected segments without valid inner credentials.

An attacker with access to a valid EAP outer-tunnel identity connects to a strongSwan IKEv2 VPN gateway configured to use EAP-TTLS or EAP-PEAP. By exploiting the server's failure to verify inner method completion, the attacker omits or truncates the inner credential exchange, causing the gateway to incorrectly authorize a VPN session. The attacker then gains access to the protected network segment as a fully authenticated peer. No public exploit code has been identified at time of analysis.