CVE-2026-59847
Redhat Enterprise Linux 10.0 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2026-59847 is a medium-severity Incorrect Check of Function Return Value (CWE-253) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Pre-OS Boot (T1542); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-46255
Vulnerability Data
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring flaw remediation and firmware update mechanisms directly ensures ROM code can be patched, eliminating the design weakness.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper error-handling and return-value checking during development.
Life-cycle management encompasses planning for updateability or timely replacement of immutable components.
Directly requires patching; inability to patch ROM forces reliance on replacement or acceptance of residual risk.
Addresses hardware that cannot be updated by requiring replacement when security capabilities are lacking.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches missing or incorrect return-value checks.
Secure SDLC mandates return-value checks and error handling, directly reducing CWE-253.
Application security requirements include robust error handling that mitigates incorrect return-value checks.
Secure architecture principles require defensive coding practices such as validating function results.
Secure coding explicitly demands checking return values, covering most of CWE-253.
Vulnerability management explicitly requires timely patching of firmware/ROM, directly addressing the inability to patch ROM code.