CVE-2026-19745 Calix CVE debrief

Who should care

Defenders responsible for Calix GigaSpire 26.1.0 Web Management Interface should assess exposure, verify the existence of the vulnerability with the vendor, and monitor for potential denial of service attacks. Security teams and vulnerability management teams should review the CVE record and NVD entry for further details and plan vendor-supported updates or mitigations where exposure is confirmed.

Why it matters

A reported vulnerability in Calix GigaSpire 26.1.0 Web Management Interface requires verification and potential defensive actions.

• Potential denial of service attacks against the Web Management Interface
• Need to verify the existence of the vulnerability with the vendor
• Possible impact on the availability of the Web Management Interface

Technical summary

A flaw in the utilities_configurationsave.cgi file of the Web Management Interface in Calix GigaSpire 26.1.0 can be exploited remotely to cause a denial of service. The vendor disputes the vulnerability, stating that the observed delay is due to expected input-timeout handling. The vulnerability involves an unknown function that can be manipulated via the sessionKey argument. Defenders should assess the potential impact on the availability of the Web Management Interface and verify the existence of the vulnerability.

Defensive priority

Low

Recommended defensive actions

• Review the CVE record and NVD entry for further details
• Verify the existence of the vulnerability with the vendor
• Monitor the Web Management Interface for potential denial of service attacks
• Assess exposure of Calix GigaSpire 26.1.0 Web Management Interface deployments
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details about the reported vulnerability in Calix GigaSpire 26.1.0 Web Management Interface. However, the vendor disputes the existence of the vulnerability, stating that the observed delay is due to expected input-timeout handling. Defenders should verify the existence of the vulnerability with the vendor and assess potential exposure. The reported vulnerability involves a manipulation of the sessionKey argument in the utilities_configurationsave.cgi file, potentially leading to a denial of source

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.