CVE-2026-32297

Critical

Published: 17 March 2026

Published

17 March 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0053 40.5th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-32297 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Angeet Es3 Kvm Firmware. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-32297 affects the Angeet ES3 KVM, enabling a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. This vulnerability, published on 2026-03-17, is rated 7.5 on the CVSS v3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and maps to CWE-306 (Missing Authentication for Critical Function). Overwriting such files compromises system integrity, potentially leading to full attacker control.

A remote attacker requires only network access to the vulnerable Angeet ES3 KVM, with no privileges, authentication, or user interaction needed. Successful exploitation allows modification of configuration files or system binaries, enabling the attacker to achieve complete control of the affected system.

Mitigation guidance is available in related advisories, including the Eclypsium analysis at https://eclypsium.com/blog/kvm-devices-the-keys-to-your-kingdom-are-hanging-on-the-network/, the CISA CSAF document at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json, and the official CVE record at https://www.cve.org/CVERecord?id=CVE-2026-32297.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-12612

Vulnerability details

The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Modified configuration files or system binaries could allow an attacker to take complete control of a vulnerable system.

CWE(s): CWE-306

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1554 Compromise Host Software Binary Persistence

Adversaries may modify host software binaries to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Remote unauthenticated arbitrary file write (incl. system binaries/configs) on public-facing KVM device directly maps to T1190 for initial access and enables T1554 by overwriting host binaries to achieve full control.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0