CVE-2026-78135 strongSwan CVE debrief

Who should care

Defenders responsible for strongSwan deployments should assess exposure and prioritize patching or mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams. Defenders should review IKEv2 state machine configurations for potential vulnerabilities and monitor for unusual authentication activity. Additionally, defenders should verify if strongSwan versions 5.9.7

Why it matters

CVE-2026-78135 is a medium-severity vulnerability in strongSwan that can lead to authentication bypass. Defenders should verify affected versions, prioritize patching, and monitor for unusual authentication activity.

• Potential authentication bypass in IKEv2 state machine.
• Possible impact on confidentiality and integrity.

Technical summary

The libcharon IKEv2 state machine mishandles CREATE_CHILD_SA requests, potentially leading to authentication bypass in strongSwan versions 5.9.7 through 6.0.7. This vulnerability affects the IKEv2 state machine and can be triggered by crafted requests. Defenders should prioritize verifying affected versions and applying patches or mitigations. The vulnerability has a CVSS score of 5.6 and is considered medium severity.

Defensive priority

Defenders should prioritize verifying affected versions and applying patches or mitigations.

Recommended defensive actions

• Verify if strongSwan versions 5.9.7 through 6.0.7 are in use and apply patches or mitigations as available.
• Review IKEv2 state machine configurations for potential vulnerabilities.
• Monitor for unusual authentication activity.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Defenders should verify affected versions and apply patches or mitigations as available. The vulnerability has been publicly disclosed, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. There is no evidence of public exploitation, but defenders should plan vendor-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.