PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-102486 NTPsec CVE debrief

A remote attacker can crash the NTPsec ntpd daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length. This issue affects NTPsec ntpd versions 1.1.4 through 1.2.5. The vulnerability allows an attacker to cause a denial-of-service condition. Defenders should assess exposure and prioritize verification of version 1.2.6 or later. Restricting access to the daemon from untrusted sources can help mitigate potential exploitation attempts. The CVE Program record and NVD vulnerability detail provide information on the out-of-bounds read vulnerability in NTPsec ntpd.

Vendor
NTPsec
Product
ntpd
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-29
Advisory published
2026-10-21
Advisory updated
2026-10-29

Who should care

Defenders responsible for NTPsec ntpd deployments should assess exposure and prioritize verification of version 1.2.6 or later. Restricting access to the daemon from untrusted sources can help mitigate potential exploitation attempts.

Why it matters

CVE-2026-102486 allows a remote attacker to crash the NTPsec ntpd daemon. Defenders should prioritize verifying NTPsec ntpd version 1.2.6 or later and restricting access to the daemon from untrusted sources.

  • Crash of NTPsec ntpd daemon may cause time synchronization issues.
  • Potential for exploitation attempts from untrusted sources.
  • Verification of NTPsec ntpd version 1.2.6 or later is required.

Technical summary

The NTPsec ntpd daemon is vulnerable to an out-of-bounds read when parsing NTS extension fields. A remote attacker can exploit this issue by sending an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, causing the daemon to crash. The vulnerability affects NTPsec ntpd versions 1.1.4 through 1.2.5. Defenders should prioritize verifying NTPsec ntpd version 1.2.6 or later and restricting access to the daemon from untrusted sources. The vulnerability has been reported and verified by multiple sources, including the CVE Program and NIST NVD.

Defensive priority

Defenders should prioritize verifying NTPsec ntpd version 1.2.6 or later and restricting access to the daemon from untrusted sources.

Recommended defensive actions

  • Verify NTPsec ntpd version 1.2.6 or later is deployed.
  • Restrict access to the NTPsec ntpd daemon from untrusted sources.
  • Monitor NTPsec ntpd logs for potential exploitation attempts.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the out-of-bounds read vulnerability in NTPsec ntpd. Supplemental sources include GitLab work items and commit records. The vulnerability has been reported and verified by multiple sources, including the CVE Program and NIST NVD. Defenders should verify the NTPsec ntpd version and restrict access to the daemon from untrusted sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-102486 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-102486

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-102486 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102486

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Out-of-bounds Read in ntpsec

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102486.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.com/NTPsec/ntpsec/-/work_items/891

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.com/NTPsec/ntpsec/-/work_items/895

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.com/NTPsec/ntpsec/-/commit/7cc079387

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.