CVE-2026-66279: Dis-connect vulnerability in Connect Stack
In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Connect SDK 4.3.1 or earlier or Flex SDK 3.7.7 or earlier are affected. The provided information does not identify any configuration prerequisite beyond processing a message with invalid security settings.
What does an attacker need to do to exploit this issue?
An attacker needs to send a message with invalid security settings. Successful exploitation may bypass authentication and cause network disruption.
Does this vulnerability expose the Network Key or compromise confidentiality?
No. The vulnerability does not allow an attacker to obtain the Network Key or otherwise break confidentiality.