Cyber Resilience

CVE-2026-50086

Critical

Published: 12 June 2026

Published
12 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0022 12.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-50086 is a critical-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Runzero (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability details

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an…

more

estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

CWE(s)
CWE-327

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Public-facing IAM/SSO gateway missing auth for signing-key crypto ops directly enables remote exploitation (T1190) and subsequent use of forged/valid accounts (T1078).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Affected Assets

Runzero
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-5 Contacts with Security Groups and Associations
addresses: CWE-327

Contacts with security groups provide timely information on broken or risky cryptographic algorithms, reducing the likelihood of their selection and use.

PM-15 Security and Privacy Groups and Associations
addresses: CWE-327

Ongoing education and sharing of recommended practices helps organizations identify and migrate away from broken or risky cryptographic algorithms.

PM-16 Threat Awareness Program
addresses: CWE-327

Cross-organization threat feeds commonly include advances in cryptanalysis and active exploits against weak or broken algorithms, allowing organizations to deprecate them proactively.

PM-3 Information Security and Privacy Resources
addresses: CWE-327

Capital planning and funding allow selection and ongoing support of strong cryptographic algorithms rather than weak or broken ones.

RA-4 Risk Assessment Update
addresses: CWE-327

Risk updates surface newly-broken or risky cryptographic algorithms as threat intelligence and computing advances evolve, enabling timely replacement.

RA-5 Vulnerability Monitoring and Scanning
addresses: CWE-327

Scanners flag use of broken or weak cryptographic algorithms via known-vulnerability databases.

SC-13 Cryptographic Protection
addresses: CWE-327

Enforces approved cryptographic algorithms for each use case, blocking use of broken or risky algorithms.

SI-2 Flaw Remediation
addresses: CWE-327

Flaw remediation replaces broken or risky cryptographic algorithms once safer implementations are released by vendors.

References