Moxa MGate CVE-2026-86325

Exploitation requires an authenticated session as a low-privilege read-only user on the MGate protocol gateway's web management interface (PR:L), reached over the network with no user interaction. The specific trigger is the account_name parameter in account-management requests, which lacks sufficient length validation; supplying an over-length value overflows an internal stack buffer. The principal limiting factor is the authentication requirement - the attacker must already possess valid (even read-only) credentials - which constrains purely anonymous remote exploitation, though read-only accounts typically present a low barrier in practice.

This is a genuinely high-priority vulnerability, though the raw 9.4 score slightly overstates the ease of exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring no user interaction, but PR:L means the attacker must first hold valid credentials - specifically a read-only web-management account. The impact ceiling is severe: the stack overflow enables memory disclosure (credentials), arbitrary memory modification, and denial of service, which maps to the VC:H/VI:H/VA:H impact set. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk driver here is the combination of a very low authentication bar (read-only accounts are often shared or weakly protected in OT environments) with full device compromise potential on a protocol gateway that bridges industrial networks. Note the vendor-supplied 4.0 vector asserts subsequent-system impact (SC/SI/SA:H); the description only documents impact to the gateway itself, so the cross-system impact claim should be verified against the vendor advisory rather than assumed.

An attacker who has obtained or been granted a low-privilege read-only account on the MGate web management interface submits an account-management request containing an oversized account_name value. The overflow corrupts the stack, letting the attacker read credentials from device memory, overwrite memory to alter execution flow, or crash the gateway. No public exploit code is identified at time of analysis, so this would currently require original exploit development.