EUVD-2026-52870
GHSA-98pg-jf9w-9qqg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network with listening Keysight Endpoint
-
DeliverySend specially crafted packet
-
ExploitOverflow stack buffer in parser
-
ExecutionOverwrite return address, hijack flow
-
PersistExecute arbitrary code as administrator
-
ImpactPivot into test/management network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a listening Keysight test component - specifically an IxChariot Endpoint/agent (or a Hawkeye, IxTap, IxProbe, or IxBypass service) that accepts the crafted packet on its measurement/control port. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no special privileges, no user interaction, and no additional attack requirements are needed against default configurations - the primary limiting factor is whether the vulnerable Endpoint is network-reachable from the attacker. Realistic exposure is therefore constrained by deployment: these agents typically run in lab or network-operations segments, so an attacker must already be on a network that can route to the listening service, and no evidence indicates internet-facing default exposure. |
| Impact | All available signals point to genuine high risk rather than an inflated score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity and availability impact - the worst realistic profile for a remote flaw, and it was assigned/reported through CISA (cisa-cg) with a corresponding CSAF advisory. Mitigating the urgency: this is not on CISA KEV, no POC or exploit code is referenced, and no EPSS score was provided, so there is no evidence of active or widespread exploitation yet. The main tempering factor is deployment footprint - these are specialized test/measurement tools usually confined to lab, staging or network-operations segments rather than internet-facing production, so real-world exposure depends heavily on where the Endpoints are reachable. Net: treat as a high-priority patch wherever these agents run on reachable networks, while noting exploitation is currently theoretical (no confirmed in-the-wild activity). |
| Exploit ScenarioDerived | An attacker with network access to a segment where an IxChariot Endpoint (or Hawkeye/IxProbe/IxTap/IxBypass agent) is listening sends a single crafted packet to the service, overflowing a stack buffer in the packet parser. This overwrites the return address to hijack execution, running attacker code as an administrator without any credentials or user interaction - giving a foothold from which to pivot deeper into the test/management network. No public POC or exploit code is currently referenced, so exploitation would require the attacker to develop the overflow independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 04, 2026
Remote code execution in Keysight IxChariot Endpoint and related Keysight network-test products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single specially crafted packet. The flaw is a classic stack-based buffer overflow reachable over the network with no user interaction (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the trivial attack complexity and lack of any authentication make it a high-priority patch for any environment running these test tools.
Earlier versions of this analysis (1)
Remote code execution in Keysight IxChariot Endpoint and related Keysight test/measurement products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single crafted packet. The flaw is a classic stack-based buffer overflow (CWE-121) reachable over the network with no user interaction, carrying a critical CVSS 9.8. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: consult the Keysight IxChariot security advisory (https://www.keysight.com/us/en/about/quality-and-security/security/product-and-solution-cyber-security/security-advisory-archive/security-advisory--ixchariot-vulnerability.html) and the CISA CSAF advisory va-26-216-01 (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-216-01.json) for the fixed release for each affected product (IxChariot, Hawkeye, IxTap, IxProbe, IxBypass) and upgrade to it - exact fix versions were not included in the analyzed data and must be taken from the vendor advisory rather than assumed. Until patched, restrict network reachability of the IxChariot Endpoint/agent and other Keysight test components: place them on an isolated management/test VLAN, and use host or network firewall rules to allow the measurement/control ports only from known IxChariot Console/controller hosts (this blocks the crafted-packet path but will break any distributed tests that rely on broad Endpoint reachability). Where a component is not in active use, stop or disable the listening service to remove the attack surface entirely, accepting that scheduled or on-demand tests using that Endpoint will fail until it is re-enabled and patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are Keysight's performance/network-testing suite: IxChariot generates and measures traffic between distributed Endpoints, while Hawkeye, IxTap, IxProbe and IxBypass provide network assessment, tap, probe and bypass functionality. The vulnerability is CWE-121 (Stack-Based Buffer Overflow): a network-facing parser copies attacker-controlled packet data into a fixed-size stack buffer without adequate bounds checking, overwriting the saved return address and adjacent stack frame. Because the vulnerable Endpoint/agent listens for measurement traffic on the network and typically runs with elevated (administrative) rights, a successful overflow yields immediate high-privilege code execution rather than a mere crash.
Know when Ixchariot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable crafted packet with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding admin-level code execution, so full C/I/A impact; scope unchanged as impact stays within the host.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
4DescriptionCVE.org
Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.
Executive ViewAI
Keysight IxChariot Endpoint and related network-test products (Hawkeye, IxTap, IxProbe, IxBypass) contain a critical remote code execution vulnerability enabling unauthenticated attackers to execute arbitrary code with administrative privileges through a single network packet. Any organization operating these tools for network testing faces immediate, exploitable risk; the trivial attack complexity and complete absence of authentication or user-interaction requirements mean compromise can occur without technical barriers. Leadership should prioritize asset inventory and access controls while awaiting a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations include: implement network segmentation and firewall rules restricting unauthenticated access to affected systems; disable systems when not in active use; disable or restrict remote network-facing services if local-only testing is the use case; deploy enhanced logging and alerting to detect suspicious network connections and anomalous process execution; maintain an updated asset inventory to support rapid containment in the event of exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB