CVE-2026-26315

High

Published: 19 February 2026

Published

19 February 2026

Modified

23 February 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0003 8.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26315 is a high-severity Observable Discrepancy (CWE-203) vulnerability in Ethereum Go Ethereum. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-30 Concealment and Misdirection

addresses: CWE-203

Misdirection can normalize or falsify responses to eliminate observable discrepancies that aid reconnaissance.

SC-31 Covert Channel Analysis

addresses: CWE-203

Observable discrepancies in system behavior can be modulated to create covert storage or timing channels; the required analysis detects and constrains such avenues.

SI-11 Error Handling

addresses: CWE-203

Prevents attackers from using observable differences in error responses to infer internal system details or state.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1212 Exploitation for Credential Access Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

attack.mitre.org →

Why these techniques?

Remote unauthenticated exploitation of exposed Geth P2P node via ECIES flaw directly enables T1190 (Exploit Public-Facing Application) and T1212 (Exploitation for Credential Access) to recover node private key bits.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is…

resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.

Deeper analysisAI

CVE-2026-26315 is a cryptographic vulnerability in go-ethereum (Geth), a Golang implementation of the Ethereum protocol's execution layer. Prior to version 1.16.9, a flaw in the ECIES cryptography implementation allows an attacker to extract bits of the p2p node key. The issue carries a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-203 (Observable Discrepancy).

Remote attackers with network access to a vulnerable Geth node can exploit this flaw without authentication, privileges, or user interaction. Exploitation enables partial recovery of the p2p node key bits, leading to high confidentiality impact by potentially undermining the security of peer-to-peer communications.

The vulnerability is resolved in Geth releases v1.16.9 and v1.17.0. Geth maintainers recommend rotating the node key after upgrading by removing the file `<datadir>/geth/nodekey` before restarting the software. Additional details are available in the GitHub Security Advisory at https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8.