Cyber Resilience

CVE-2026-6092

Low

Published: 25 June 2026

Published
25 June 2026
Modified
27 June 2026
KEV Added
—
Patch
—
CVSS Score v4 2.1 CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
EPSS Score 0.0021 11.0th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-6092 is a low-severity Algorithm Downgrade (CWE-757) vulnerability in Wolfssl Wolfssl. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Weaken Encryption (T1600); ranked at the 11.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability details

When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.

CWE(s)
CWE-757

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1600 Weaken Encryption Defense Impairment
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
attack.mitre.org →
Why these techniques?

CWE-757 crypto negotiation flaw directly enables weakening of encryption (Encrypt-then-MAC enforcement failure).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-7396Same product: Wolfssl Wolfssl
CVE-2024-1544Same product: Wolfssl Wolfssl
CVE-2026-6331Same product: Wolfssl Wolfssl
CVE-2026-6450Same product: Wolfssl Wolfssl
CVE-2026-5503Same product: Wolfssl Wolfssl
CVE-2021-3336Same product: Wolfssl Wolfssl
CVE-2026-55960Same product: Wolfssl Wolfssl
CVE-2025-7394Same product: Wolfssl Wolfssl
CVE-2026-7532Same product: Wolfssl Wolfssl
CVE-2022-34293Same product: Wolfssl Wolfssl

Affected Assets

wolfssl
wolfssl
5.2.0 — 5.9.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Windows 10 (1 rule)
  • V-220938 The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM. via CWE-757
Windows 11 (1 rule)
  • V-253462 The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM. via CWE-757
Windows Server 2016 (1 rule)
  • V-225054 The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM. via CWE-757
Windows Server 2019 (1 rule)
  • V-205919 Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. via CWE-757
Windows Server 2022 (1 rule)
  • V-254475 Windows Server 2022 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. via CWE-757

References