VulnerabilityPublished 2 Nov 2026

CVE-2026-68591: MediaTek chipset · Incorrect Permissions

Affects MediaTek chipsetSource CVE Database V5

Compare

Not known to be exploited.

Data as of 2 Nov 2026, 03:13 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 1 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
MediaTek, Inc.MediaTek chipset	Affected MT2737 – MT8883 22 affected builds	Fixed in–

AI-suggested

The provided data references patch IDs but does not confirm availability or deployment. Users and administrators should monitor MediaTek advisories for official fixes and apply them once available.

Description

CVE-2026-68591 is a vulnerability in MediaTek chipsets involving incorrect permission assignment in the modem component. This flaw allows a permissions bypass that could lead to local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. Multiple MediaTek chipset models are affected.

Impact

The impact is a local escalation of privilege, which could allow an attacker who already has System-level access to gain higher privileges or bypass security controls. This could compromise the security of the affected device. No remote exploitation or user interaction is needed.

Summary

This vulnerability, identified as CWE-732, exists in the modem of various MediaTek chipsets. It involves incorrect permission assignment for critical resources, enabling a permissions bypass. An attacker with existing System privileges could exploit this flaw to escalate privileges locally. No user interaction is required for exploitation. The issue is tracked under MediaTek's internal ID MSV-2958 and patches are referenced by IDs ALPS09608864 and ALPS09327759, though no explicit patch availability is confirmed in the provided data.

CWE-732Incorrect Permission Assignment for Critical Resource (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Implementation
When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user), and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly.
Architecture and Design · Operation · Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OWASP Cheat Sheets
REST Assessment (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V4.3.3 (opens in a new tab)
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
Attack patterns
Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
Directory Indexing (opens in a new tab)
Using Malicious Files (opens in a new tab)
Exploiting Incorrectly Configured Access Control Security Levels (opens in a new tab)
Signing Malicious Code (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

mediatek.com/product-security-bulletin/November-2026 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 2 Nov 2026, 03:13 UTC

WeaknessesCWE-732

Technical details

References

Community reviews

Related threats