Is CVE-2026-1709 being actively exploited?

CVE-2026-1709 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2026-1709?

CVE-2026-1709 has a CVSS 3.1 base score of 9.4 (CRITICAL).

CVE-2026-1709

CRITICAL · CVSS 9.4EPSS 5.8%EU EUVD

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

Key facts

CVSS score: 9.4 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness (CWE): CWE-322
EPSS score: 5.8% (93th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2026-5599)
Published: February 6, 2026
NVD last modified: July 15, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-5599 in the EU Vulnerability Database. Last updated in EUVD on July 15, 2026.

View on the EU Vulnerability Database

Affected products

keylime / keylime
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux eus
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for power little endian
redhat / enterprise linux for power little endian
redhat / enterprise linux for power little endian eus

Certified products that may be affected

8 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5034 - active
Red Hat Enterprise Linux 9 NSS Cryptographic Module - Red Hat, Inc - FIPS 140 5022 - active
Red Hat Enterprise Linux 9 gnutls - Red Hat, Inc. - FIPS 140 4846 - active

See all 8 in the Security Certifications Explorer.

References

https://access.redhat.com/errata/RHSA-2026:2224(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2026:2225(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2026:2298(Third Party Advisory)
https://access.redhat.com/security/cve/CVE-2026-1709(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=2435514(Issue Tracking, Third Party Advisory)
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1709.json

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain