Cyber Resilience

CVE-2026-56985

Published
15 September 2026
Modified
16 September 2026
CVSS Score v3.1 8.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 2th percentile
Risk Priority 58 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-56985 is a high-severity Confused Deputy (CWE-441) vulnerability in Android (inferred from references). Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Proxy (T1090); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

In multiple files, there is a possible way to obtain signatures due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CWE(s)
CWE-441

Related Threats

MITRE ATT&CK Enterprise Techniques

T1090 Proxy Command And Control
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
attack.mitre.org →
T1090.001 Internal Proxy Command And Control
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.
attack.mitre.org →
T1090.002 External Proxy Command And Control
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

Affected Assets

Android
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.2.1
  • V3.5.1
  • V3.5.3
  • V3.5.8

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-32 System Partitioning
addresses: CWE-441

Mitigates confused deputy risks by ensuring distinct privilege domains so one partition cannot unintentionally act on behalf of another.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 partial match
prevents

Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.

PR.AA-05 partial match
prevents

Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
prevents

Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.

A.5.16 Identity management partial match
prevents

Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.

A.5.18 Access rights partial match
degrades

Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.

A.8.2 Privileged access rights partial match
degrades

Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.

A.8.20 Networks security partial match
degrades

Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.

A.8.25 Secure development life cycle partial match
prevents

Secure-SDLC practices include design reviews that detect and eliminate confused-deputy proxy patterns before deployment.

References