This vulnerability (CVE-2026-8676) in silabs.com Simplicity SDK involves an authentication bypass (CWE-290) through spoofing. An attacker can delete an existing Bluetooth LE bond, impersonate the bonded device, and establish a new bond, thereby downgrading the security of the connection. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has not published a patch or remediation level, and the product is not a cloud service.

Successful exploitation allows an attacker to bypass Bluetooth LE authentication mechanisms by spoofing a bonded device, which can lead to unauthorized access and control over the connection. This compromises confidentiality, integrity, and availability of the Bluetooth LE communication channel.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of affected devices and monitor for vendor updates. No vendor-provided mitigation or temporary fix is currently documented.