CVE-2026-3559

High

Published: 16 March 2026

Published

16 March 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v3 8.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0040 31.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-3559 is a high-severity Reusing a Nonce, Key Pair in Encryption (CWE-323) vulnerability in Philips Hue Bridge V2 Firmware. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-12160

Vulnerability details

Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the…

configuration of the SRP authentication mechanism in the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the use of a static nonce value. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28451.

CWE(s): CWE-323

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Static nonce flaw in exposed HomeKit SRP service on TCP 8080 directly enables remote authentication bypass without credentials, mapping to exploitation of the network-accessible service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0