CVE-2026-32295
Published: 17 March 2026
Summary
CVE-2026-32295 is a critical-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Jetkvm Kvm. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32295 affects JetKVM versions before 0.5.4, where the software fails to rate limit login requests. This design flaw enables brute-force attacks to guess credentials, as classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its high severity due to network accessibility and potential for significant confidentiality impact.
Attackers with network access to a vulnerable JetKVM instance can exploit this without prior privileges or user interaction. By sending repeated login attempts, they can systematically guess credentials, potentially compromising access to the device's KVM (keyboard, video, mouse) functionality and exposing sensitive remote control capabilities.
Mitigation involves upgrading to JetKVM version 0.5.4, available via the project's GitHub release page, which addresses the rate limiting deficiency. Advisories from Eclypsium, CISA (via CSAF document VA-26-076-01), and the official CVE record detail the issue and emphasize applying the patch promptly.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12608
Vulnerability details
JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Lack of login rate limiting directly enables brute-force credential guessing (T1110 / T1110.001) against the exposed JetKVM web interface.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-7 enforces limits on consecutive unsuccessful logon attempts and account locking, directly preventing brute-force credential guessing as exploited in CVE-2026-32295.
SI-2 requires timely identification, reporting, and patching of system flaws like the missing rate limiting in JetKVM before version 0.5.4.
SC-5 employs safeguards against denial-of-service events, mitigating excessive login requests that enable brute-force attacks on vulnerable JetKVM instances.