PatchSiren cyber security CVE debrief

CVE-2026-105960 HMS Networks CVE debrief

CVE-2026-105960 is a vulnerability in HMS Networks PEAK-System PCAN Windows drivers due to improper handling of length parameter inconsistency. This issue allows for potential denial of service or information disclosure. Affected versions of PEAK-System Device Driver Setup and PCAN Windows CAN device drivers are versions up to 5.1.2.1151 and 5.1.2 respectively. The vulnerability was published on October 20, 2026.

Vendor: HMS Networks
Product: PEAK-System Device Driver Setup
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders of ICS and industrial control systems using PEAK-System Device Driver Setup and PCAN Windows CAN device drivers should assess their exposure and consider upgrading to version 5.1.4 or later.

Why it matters

CVE-2026-105960 is a medium-severity vulnerability in HMS Networks PEAK-System PCAN Windows drivers. Defenders of ICS and industrial control systems should assess exposure, verify system inventory, and consider upgrading to mitigate potential denial of service or information disclosure risks.

Potential denial of service or system instability
Possible information disclosure
Need for verification of system inventory and exposure
Priority for upgrading to a fixed version

Technical summary

The HMS Networks PEAK-System PCAN Windows drivers are vulnerable to improper handling of length parameter inconsistency. This could allow an attacker to potentially cause a denial of service or information disclosure. The affected versions are PEAK-System Device Driver Setup up to 5.1.2.1151 and PCAN Windows CAN device drivers up to 5.1.2. The vulnerability has been assigned a CVSS score of 5.5 and a severity of MEDIUM.

Defensive priority

Medium priority for ICS and industrial control systems using affected PEAK-System Device Driver Setup and PCAN Windows CAN device drivers; verify system inventory and assess exposure.

Recommended defensive actions

Verify system inventory to identify potentially affected PEAK-System Device Driver Setup and PCAN Windows CAN device drivers
Assess exposure based on current version usage
Consider upgrading to version 5.1.4 or later
Monitor system logs for potential denial of service or information disclosure attempts
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability. However, additional information on potential exploits or victim organizations is not available in the provided corpus. Defenders should verify system inventory, assess exposure, and consider upgrading to version 5.1.4 or later. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. Affected versions of PEAK-System Device Driver Setup and PCAN Windows CAN device drivers are versions up to 5.1.2.1151 and 5.1.2 respectively.

Sources and references

Verified primary and authoritative sources

CVE-2026-105960 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-105960

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-105960 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105960

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistenc
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105960.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://www.hms-networks.com/cybersecurity

Supplemental source
Source reference
Unverified legacy reference

URL: https://www.peak-system.com/support/downloads/software/

Supplemental source
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-01.json

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.