CVE-2026-95699 MrSteam CVE debrief

Who should care

Defenders responsible for the iSteamX mobile application, especially those in environments where the application is used, should assess exposure and prioritize mitigation. This includes reviewing the application's AWS policy, restricting access to MQTT topics, and monitoring device data and user activity for suspicious behavior. Additionally, defenders should verify the application version and ensure it is up-to-date, and review compensating controls for

Why it matters

CVE-2026-95699 is a high-severity vulnerability in the iSteamX mobile application that could allow authenticated users to access wildcard MQTT topics, potentially exposing other users' device data and allowing attackers to start and stop other connected users' devices. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where the iSteamX mobile application is used.

• Potential exposure of user profile information
• Possible unauthorized device activation
• Potential scalding due to unintended device activation
• Verification of affected versions and remediation is required

Technical summary

The iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, potentially exposing other users' device data and allowing attackers to start and stop other connected users' devices. This vulnerability is significant because it could allow attackers to access sensitive information and take control of devices. The technical impact of this vulnerability is that it could allow attackers to access and manipulate device data, emphasizing the need for defenders to prioritize verifying and mitigating this vulnerability.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where the iSteamX mobile application is used.

Recommended defensive actions

• Verify the iSteamX mobile application version and ensure it is up-to-date
• Review and restrict access to MQTT topics
• Monitor device data and user activity for suspicious behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information about affected versions and remediation is limited. The iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, potentially exposing other users' device data and allowing attackers to start and stop other connected users' devices. However, specific details about the affected versions, patch availability, and remediation steps are not provided in the CVE record or NVD entry. Defenders should

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.