CVE-2026-92853 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for systems using NetX Duo versions prior to 6.5.2.202603 should assess exposure and prioritize verification and updates. The vulnerability has a high severity score and defenders should prioritize verification and updates, especially for systems using NetX Duo versions prior to 6.5.2.202603.

Why it matters

CVE-2026-92853 is a high-severity vulnerability in NetX Secure that allows for out-of-bounds reads via a zero-length TLS 1.3 Certificate message. Defenders should prioritize verification and updates, and assess exposure in their systems, especially those using affected NetX Duo versions.

• Potential for pre-authentication exploitation
• Risk of out-of-bounds read and potential data exposure
• Need for verification and updates to NetX Secure
• Potential impact on systems using affected NetX Duo versions

Technical summary

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The vulnerability is triggered by a four-byte handshake header and does not require cryptographic validity, making it reachable pre-authentication. The issue has a high severity score and defenders should prioritize verification and updates.

Defensive priority

Defenders should prioritize verifying and updating NetX Secure to version 6.5.2.202603 or later, and assess exposure in their systems, especially those using NetX Duo versions prior to 6.5.2.202603.

Recommended defensive actions

• Verify and update NetX Secure to version 6.5.2.202603 or later
• Assess exposure in systems using NetX Duo versions prior to 6.5.2.202603
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. The source item and supplemental source reference offer additional context. The vulnerability is a high-severity issue in NetX Secure that allows for out-of-bounds reads via a zero-length TLS 1.3 Certificate message. Defenders should prioritize verification and updates, and assess exposure in their systems, especially those using affected NetX Duo versions. The CVE record was published on 2026-10-20T15:10:08.102Z and has not been modified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.