A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. (CVE-2026-75944)
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.
AI Analysis
Technical Summary
This vulnerability arises from a race condition during the re-authentication process of a supplicant, which may cause a stale Access Control List (ACL) entry to persist in the system. When the AclAgent subsequently restarts, it may apply this stale ACL entry to new supplicants, resulting in incorrect enforcement of access controls. The issue requires an administrator to restart the AclAgent for the stale entry to affect new connections. The CVSS 3.1 base score is 2.6, reflecting low impact on integrity and no impact on confidentiality or availability.
Potential Impact
The vulnerability can lead to incorrect access control enforcement due to stale ACL entries being applied after an AclAgent restart. This could potentially allow or deny access improperly, affecting system integrity. There is no impact on confidentiality or availability. Exploitation requires user interaction in the form of an administrator restarting the AclAgent.
Mitigation Recommendations
No patch or official fix information is currently available. Since the issue requires an administrator to restart the AclAgent for the stale ACL entry to take effect, minimizing unnecessary restarts may reduce risk. Monitor vendor advisories for updates or patches addressing this race condition.
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. (CVE-2026-75944)
Description
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.
CVSS v3.1
Score 2.6low
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from a race condition during the re-authentication process of a supplicant, which may cause a stale Access Control List (ACL) entry to persist in the system. When the AclAgent subsequently restarts, it may apply this stale ACL entry to new supplicants, resulting in incorrect enforcement of access controls. The issue requires an administrator to restart the AclAgent for the stale entry to affect new connections. The CVSS 3.1 base score is 2.6, reflecting low impact on integrity and no impact on confidentiality or availability.
Potential Impact
The vulnerability can lead to incorrect access control enforcement due to stale ACL entries being applied after an AclAgent restart. This could potentially allow or deny access improperly, affecting system integrity. There is no impact on confidentiality or availability. Exploitation requires user interaction in the form of an administrator restarting the AclAgent.
Mitigation Recommendations
No patch or official fix information is currently available. Since the issue requires an administrator to restart the AclAgent for the stale ACL entry to take effect, minimizing unnecessary restarts may reduce risk. Monitor vendor advisories for updates or patches addressing this race condition.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h9qv-gg29-5v6f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-75944"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8a16455bf5e2cf5f3b7a9
Added to database: 09/15/2026, 01:37:40 UTC
Last enriched: 09/15/2026, 01:41:53 UTC
Last updated: 09/15/2026, 03:01:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.