CVE-2026-44091
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-44091 is a high-severity Trust Boundary Violation (CWE-501) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and AC-16 (Security and Privacy Attributes) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-51026
Vulnerability Data
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement directly stops trusted and untrusted data from being combined by applying rules that govern allowable data movements and combinations.
Associating explicit security attributes with data objects enables enforcement mechanisms that keep trust levels from being mixed inside structures.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices (coding standards, reviews, validation) directly prevent mixing trusted and untrusted data inside the same structures.
Documented data-flow representations make trust boundaries explicit and help surface mixing of trusted/untrusted data.
Logical segmentation and access controls enforce separation between trust domains, reducing the chance of co-mingled data structures.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.
Secure coding standards can enforce input validation and data tagging, but do not guarantee architectural separation.
Secure development lifecycle mandates separation of trusted and untrusted data flows, directly preventing mixing in the same structure.
Application security requirements include explicit trust-boundary definitions and data classification at interfaces.
Network segregation reduces external mixing but does not address internal data-structure trust violations.
Information access restriction limits who sees data but does not prevent mixing trusted and untrusted data within structures.