CVE-2026-19735 zephyrproject CVE debrief

Who should care

Zephyr users, especially those with TCP services exposed to untrusted networks or systems that rely on TCP for secure communication. Network administrators and security teams responsible for Zephyr-based systems should assess exposure and apply patches or mitigations as necessary.

Why it matters

CVE-2026-19735 exposes Zephyr systems to predictable TCP sequence number attacks when the RFC 6528 secret key generation fails silently. Defenders should prioritize patching, assess exposure of Zephyr-based systems, and verify entropy sources.

• Potential for sequence prediction attacks on TCP connections
• Increased risk of session hijacking or injection attacks
• Need for verification of entropy source functionality
• Priority for patching or mitigating affected Zephyr systems

Technical summary

The Zephyr TCP stack's implementation of RFC 6528 for initial sequence number generation uses a 128-bit secret key generated by sys_csrand_get(). If this call fails due to entropy source issues, the failure is silently ignored, and the key is left as all zeros. This results in predictable TCP initial sequence numbers for connections established after the failure. The vulnerability allows remote attackers to potentially hijack or inject into TCP connections. Defenders should prioritize patching, assess exposure of Zephyr-based systems, and verify entropy sources. The

Defensive priority

Medium priority for Zephyr users, especially those with exposed TCP services.

Recommended defensive actions

• Review and apply the patch from https://github.com/zephyrproject-rtos/zephyr/commit/700888e3ecff8474f4fe7dfa8782b8869053222b
• Assess exposure of Zephyr-based systems, especially those with TCP services exposed to untrusted networks
• Verify the entropy source for the system's random number generation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploits or impacts. The entropy source for the system's random number generation should be verified. There is no information on known or unknown affected scope beyond the Zephyr TCP stack implementation. Defenders should verify the functionality of the entropy source and review compensating controls for exposed systems. The official CVE Program record and NIST NVD vulnerability detail offer additional context, but no

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.