Every CVE Search/ Get API key

CVE-2026-78807

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper...

7.1 HighFix available

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.08%Unchanged since Sep 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Record
CVE-2026-78807
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
EUVDEUVD-2026-76184 7.1

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Record
EUVD-2026-76184
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3gc7-g84m-84jc 7.1

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper...

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Record
GHSA-3gc7-g84m-84jc
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
NVD 7.1

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Record
CVE-2026-78807
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
OSVDEBIAN-CVE-2026-78807 7.1

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Record
DEBIAN-CVE-2026-78807
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-78807 7.1

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Record
UBUNTU-CVE-2026-78807
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 11 moreShow less
OSVAZL-103386 No score

CVE-2026-78807 affecting package wpa_supplicant 2.12-1

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

Record
AZL-103386
Updated
2026-11-05
OSVopenSUSE-SU-2026:22022-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

Security issues fixed:

  • CVE-2026-78807: missing validation in driver-based PMKSA selection within wpa_supplicant can allow local security bypasses (bsc#1280914).
Record
openSUSE-SU-2026:22022-1
Updated
2026-11-02
OSVSUSE-SU-2026:24096-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

Security issues fixed:

  • CVE-2026-78807: missing validation in driver-based PMKSA selection within wpa_supplicant can allow local security bypasses (bsc#1280914).
Record
SUSE-SU-2026:24096-1
Updated
2026-11-02
OSVSUSE-SU-2026:24132-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issue:

  • CVE-2026-78807: Security bypass via missing PMKSA validation (bsc#1280914).
  • Fix incomplete RADIUS Message-Authenticator attribute validation in hostapd
Record
SUSE-SU-2026:24132-1
Updated
2026-11-02
OSVSUSE-SU-2026:24144-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

Security issues fixed:

  • CVE-2026-78807: missing validation in driver-based PMKSA selection within wpa_supplicant can allow local security bypasses (bsc#1280914).
Record
SUSE-SU-2026:24144-1
Updated
2026-11-02
OSVSUSE-SU-2026:24278-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issue:

  • CVE-2026-78807: Security bypass via missing PMKSA validation (bsc#1280914).
Record
SUSE-SU-2026:24278-1
Updated
2026-11-02
OSVSUSE-SU-2026:4492-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

  • CVE-2026-78807: missing validation in driver-based PMKSA selection within wpa_supplicant can allow local security bypasses (bsc#1280914).
Record
SUSE-SU-2026:4492-1
Updated
2026-11-02
OSVSUSE-SU-2026:4494-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

  • CVE-2026-78807: Security bypass via missing PMKSA validation (bsc#1280914).
  • Fixed incomplete RADIUS Message-Authenticator attribute validation in hostapd
Record
SUSE-SU-2026:4494-1
Updated
2026-11-02
OSVSUSE-SU-2026:4587-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issue:

  • CVE-2026-78807: missing validation in driver-based PMKSA selection within wpa_supplicant can allow local security bypasses (bsc#1280914).
  • Fixed incomplete RADIUS Message-Authenticator attribute validation in hostapd
Record
SUSE-SU-2026:4587-1
Updated
2026-11-02
OSVSUSE-SU-2026:4588-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issue:

  • CVE-2026-78807: missing validation in driver-based PMKSA selection within wpa_supplicant can allow local security bypasses (bsc#1280914).
Record
SUSE-SU-2026:4588-1
Updated
2026-11-02
OSVSUSE-SU-2026:4590-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issue:

  • CVE-2026-78807: missing validation in driver-based PMKSA selection within wpa_supplicant can allow local security bypasses (bsc#1280914).
Record
SUSE-SU-2026:4590-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
wpa_supplicant
Azure Linux:3
 through 2.12-1 None known
wpa
Debian:12
 All versions, plus listed versions
2:2.10-122:2.10-12+deb12u12:2.10-12+deb12u22:2.10-12+deb12u32:2.10-13
Show 16 moreShow less
2:2.10-142:2.10-152:2.10-162:2.10-172:2.10-182:2.10-202:2.10-212:2.10-21.12:2.10-222:2.10-232:2.10-242:2.10-252:2.11-12:2.11-22:2.11-32:2.11-4
 None known
wpa
Debian:13
 All versions, plus listed versions
2:2.10-242:2.10-252:2.11-12:2.11-22:2.11-32:2.11-4
 None known
wpa
Debian:14
 before 2:2.11-4, plus listed versions
2:2.10-242:2.10-252:2.11-12:2.11-22:2.11-3
2:2.11-4
wpa_supplicant
SUSE:Linux Micro 6.2
 before 2.11-160000.5.1
2.11-160000.5.1
wpa_supplicant
SUSE:Linux Micro 6.0
 before 2.10-159998.1.1
2.10-159998.1.1
wpa_supplicant
SUSE:Linux Enterprise Server 16.0
 before 2.11-160000.5.1
2.11-160000.5.1
wpa_supplicant
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.11-160000.5.1
2.11-160000.5.1
wpa_supplicant
SUSE:Linux Micro 6.1
 before 2.11-slfo.1.1_3.1
2.11-slfo.1.1_3.1
wpa_supplicant
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 2.10-150600.7.11.1
2.10-150600.7.11.1
Show 24 moreShow less
Affected packages
PackageAffectedFixed
wpa_supplicant
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 2.10-150600.7.11.1
2.10-150600.7.11.1
wpa_supplicant
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 2.9-23.26.1
2.9-23.26.1
wpa_supplicant
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.9-23.26.1
2.9-23.26.1
wpa_supplicant
SUSE:Linux Enterprise Micro 5.3
 before 2.9-150000.4.45.1
2.9-150000.4.45.1
wpa_supplicant
SUSE:Linux Enterprise Micro 5.4
 before 2.9-150000.4.45.1
2.9-150000.4.45.1
wpa_supplicant
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.9-150000.4.45.1
2.9-150000.4.45.1
wpa_supplicant
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.9-150000.4.45.1
2.9-150000.4.45.1
wpa_supplicant
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.9-150000.4.45.1
2.9-150000.4.45.1
wpa_supplicant
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.9-150000.4.45.1
2.9-150000.4.45.1
wpa_supplicant
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 2.11-150700.3.6.1
2.11-150700.3.6.1
wpa_supplicant
SUSE:Linux Enterprise Micro 5.5
 before 2.10-150500.3.9.1
2.10-150500.3.9.1
wpa_supplicant
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 2.10-150500.3.9.1
2.10-150500.3.9.1
wpa_supplicant
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 2.10-150500.3.9.1
2.10-150500.3.9.1
wpa_supplicant
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 2.10-150500.3.9.1
2.10-150500.3.9.1
wpa_supplicant
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 2.10-150500.3.9.1
2.10-150500.3.9.1
wpa
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.0-3ubuntu21.0-3ubuntu31.0-3ubuntu42.1-0ubuntu12.1-0ubuntu1.1
Show 11 moreShow less
2.1-0ubuntu1.22.1-0ubuntu1.32.1-0ubuntu1.42.1-0ubuntu1.52.1-0ubuntu1.62.1-0ubuntu1.72.1-0ubuntu1.7+esm12.1-0ubuntu1.7+esm22.1-0ubuntu1.7+esm32.1-0ubuntu1.7+esm42.1-0ubuntu1.7+esm5
 None known
wpa
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4-0ubuntu32.4-0ubuntu42.4-0ubuntu52.4-0ubuntu62.4-0ubuntu6.2
Show 7 moreShow less
2.4-0ubuntu6.32.4-0ubuntu6.42.4-0ubuntu6.52.4-0ubuntu6.62.4-0ubuntu6.72.4-0ubuntu6.82.4-0ubuntu6.8+esm1
 None known
wpa
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4-0ubuntu102:2.4-1.1ubuntu12:2.6-15ubuntu12:2.6-15ubuntu22:2.6-15ubuntu2.1
Show 8 moreShow less
2:2.6-15ubuntu2.22:2.6-15ubuntu2.32:2.6-15ubuntu2.42:2.6-15ubuntu2.52:2.6-15ubuntu2.62:2.6-15ubuntu2.72:2.6-15ubuntu2.82:2.6-15ubuntu2.8+esm1
 None known
wpa
Ubuntu:20.04:LTS
 All versions, plus listed versions
2:2.9-1ubuntu22:2.9-1ubuntu32:2.9-1ubuntu42:2.9-1ubuntu4.12:2.9-1ubuntu4.22:2.9-1ubuntu4.32:2.9-1ubuntu4.42:2.9-1ubuntu4.6
 None known
wpa
Ubuntu:22.04:LTS
 All versions, plus listed versions
2:2.9.0-21build12:2.9.0-232:2.10-12:2.10-22:2.10-6
Show 6 moreShow less
2:2.10-6ubuntu12:2.10-6ubuntu22:2.10-6ubuntu2.12:2.10-6ubuntu2.22:2.10-6ubuntu2.32:2.10-6ubuntu2.4
 None known
wpa
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:2.10-152:2.10-182:2.10-202:2.10-212:2.10-21build2
Show 6 moreShow less
2:2.10-21build32:2.10-21build42:2.10-21ubuntu0.12:2.10-21ubuntu0.22:2.10-21ubuntu0.32:2.10-21ubuntu0.4
 None known
wpa
Ubuntu:26.10
 All versions, plus listed versions
2:2.11-0ubuntu52:2.11-2ubuntu2
 None known
wpa
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:2.11-0ubuntu42:2.11-0ubuntu5
 None known
wpa_supplicant
openSUSE:Leap 16.0
 before 2.11-160000.5.1
2.11-160000.5.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78807 is a high vulnerability (CVSS 7.1) in wpa_supplicant, published September 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.08%, the 0th percentile. Fixed in wpa 2:2.11-4.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open