CVE-2026-6807 NSA CVE debrief

Who should care

Organizations still operating NSA GRASSMARLIN, especially defenders responsible for industrial control system visibility, segmentation, or incident response deployments. This is most relevant where GRASSMARLIN handles sensitive session data or is accessible to users with local, low-privilege access.

Technical summary

CISA describes the flaw as insufficient hardening in the XML parsing process in GRASSMARLIN v3.2.1. The CVSS vector provided in the advisory is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local attack conditions, low privileges, no user interaction, and high confidentiality impact. The primary risk is exposure of sensitive information rather than direct integrity or availability impact.

Defensive priority

Moderate-to-high. The issue is not network-reachable per the supplied CVSS vector, but the product is end-of-life and no vendor fix is planned, so remediation depends on compensating controls and migration.

Recommended defensive actions

• Inventory any remaining NSA GRASSMARLIN deployments and confirm whether version 3.2.1 or the affected archived project is in use.
• Treat the issue as unpatchable: plan migration away from GRASSMARLIN because the project is archived and no further updates are expected.
• Restrict local access to affected systems and limit which users can submit or influence session data.
• Review data exposure paths around XML parsing and session storage for sensitive information that could be disclosed if parsing is mishandled.
• Monitor for abnormal local access or unexpected access to session-related files and logs associated with GRASSMARLIN.
• Apply least-privilege and segmentation controls around any system that still runs the software.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory for ICSA-26-118-01 / CVE-2026-6807 and its published CVSS vector. The advisory text states that crafted session data may trigger improper XML input handling and result in unintended exposure of sensitive information, and that GRASSMARLIN is end-of-life with no patches planned.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.