CVE Status & Mitigation

Overview 

Swivel Secure appliances are built on an Enterprise Linux foundation (Oracle Linux). To ensure stability, our operating system vendor utilizes backporting for security patches.

This means security fixes are applied to existing software versions without changing the major version number. Consequently, automated vulnerability scanners that rely solely on version number comparison (e.g., Nessus, Qualys, Rapid7) often report False Positives.

This document lists specific vulnerabilities that may flag on your scanners, providing evidence of mitigation or explanation of why the appliance is not affected.

Note

If you identify a vulnerability on your appliance that is not listed here, please contact Swivel Secure Support for analysis.

Updating the Appliance Kernel 

Several of the items below are resolved by applying an Oracle kernel update. Kernel updates are delivered through the CMI, but the required options are only exposed once the CMI itself is up to date.

The external-repository and package-synchronisation options live under Administration → Update Appliance → Settings. If they are not visible there, the CMI must be updated first. Updating the CMI reveals these options; they are the mechanism by which the appliance reaches Oracle’s package repositories to obtain a newer kernel.

The sequence is:

Update the CMI via Administration → Update Appliance → Update CMI Menu, if the options below are not already present.
Log out of the CMI menu and log back in. The menu only reloads on a fresh login, so the new options will not appear until you have logged out and back in after updating the CMI.
Go to Administration → Update Appliance → Settings and perform the following, in order:
1. Disable external repositories.
2. Enable external repositories.
3. Attempt to Synchronise system packages.
This disable/enable/synchronise sequence is required — synchronisation may not work if external repositories are simply left enabled without first toggling them off and on again.
Return to Administration → Update Appliance and apply the system/kernel update.
Reboot the appliance — a new kernel does not take effect until reboot.
Confirm the running kernel via the CMI main menu → Version Information → Kernel Version.

Without enabling external repositories and synchronising packages, the appliance cannot retrieve an updated kernel, and the kernel-level fixes described below cannot be applied.

Known False Positives & Mitigations 

Kernel CVEs Reported as Critical by Cloud Scanners 

Relevant CVEs: 69 Linux kernel CVEs reported against kernel-uek at Critical severity by AWS Inspector in the 2026-09-04 scan. Representative examples: CVE-2026-31402, CVE-2025-68284, CVE-2026-53309, CVE-2026-63992, CVE-2026-64125.

Scanner Status: Critical (as reported by AWS Inspector)

Appliance Status: Patched — resolved by the current Oracle UEK R7 kernel. Verified running kernel-uek-5.15.0-323.211.3.5.el9uek after a CMI system update on 2026-09-04. The fix is not active until the appliance is rebooted.

Description

Cloud vulnerability scanners that assess an appliance by package inventory will report a large number of Linux kernel CVEs. In the 2026-09-04 assessment, 69 distinct kernel CVEs were reported at Critical severity. This is expected behaviour for package-inventory scanning of any Linux system and does not, by itself, indicate that the appliance is exposed.

Two things are worth understanding about these reports.

First, the severity shown by the scanner is frequently higher than the severity assigned by the platform vendor. Oracle publishes its own assessment for each CVE in the Oracle Linux CVE database. Of five of the 69 checked individually against Oracle’s published scores:

CVE	Oracle CVSS	Affected kernel component
CVE-2026-31402	8.8	NFSv4.0 `LOCK` replay cache (NFS server role)
CVE-2026-53309	7.1	`ocfs2/dlm` cluster filesystem lock manager
CVE-2026-63992	7.0	IP tunnel path-MTU discovery
CVE-2025-68284	6.5	`libceph` (Ceph distributed storage client)
CVE-2026-64125	5.5	`bcmgenet` Broadcom GENET Ethernet driver

None of the five is rated Critical by Oracle; the scores range from 5.5 to 8.8.

Second, several of these CVEs affect kernel subsystems and hardware drivers that an AuthControl Sentry appliance has no use for. bcmgenet drives Broadcom GENET Ethernet hardware found on Raspberry Pi and Broadcom 4908-family boards; an appliance running as a VMware guest does not have that hardware. libceph and ocfs2/dlm support Ceph distributed storage and OCFS2 clustered filesystems, and the appliance uses neither in any supported configuration. CVE-2026-31402 requires the affected host to be serving NFSv4.0 to cooperating clients.

The first of these — the absence of Broadcom GENET hardware on a virtual machine — follows directly from the platform. The remainder reflect the appliance’s supported storage and service configuration rather than a per-build check of loaded kernel modules; Swivel Secure has not published module-level verification for each of the 69 CVEs, and the kernel update below is the control being relied upon in every case.

Fix and Verification (Oracle Linux 9)

All 69 are resolved by keeping the appliance’s kernel current. Swivel Secure verified on 2026-09-04 that after a CMI system update the installed kernel is kernel-uek-5.15.0-323.211.3.5.el9uek, whose version meets or exceeds the fixed version named by the scanner for every one of the 69 CVEs. (The comparison is against the fixed versions in the scanner’s own report; Oracle’s per-CVE pages identify the fixing errata but do not publish a package version in a form that could be quoted here — see the source note below.)

Apply the update through the CMI as described in “Updating the Appliance Kernel” above, then reboot. Confirm the running kernel via the CMI main menu → Version Information → Kernel Version; a value of 5.15.0-323.211.3.5 or higher confirms the fix is active.

Contextual Risk

Until the appliance is rebooted, the newly installed kernel is on disk but not running, and the previously running kernel remains in force. A scanner that reports these CVEs against an updated-but-not-rebooted appliance is reporting the running system correctly. The reboot is part of the remediation, not an optional follow-up.

Note

Oracle delivers a substantial number of UEK CVE fixes through bug fix errata (ELBA-) rather than security errata (ELSA-). Three of the five CVEs above cite ELBA-2026-500163 (2026-08-11) as the fixing erratum. Customers whose processes track only ELSA- advisories may therefore conclude a fix is unavailable when it has in fact already shipped. The kernel version, not the advisory class, is the reliable indicator.

Note

Source limitation. Oracle’s per-CVE pages cite ELBA-2026-500163 (shipping 5.15.0-323.211.3.3) as the fixing erratum for several of these CVEs. The appliance’s verified kernel 5.15.0-323.211.3.5 ships in the later ELBA-2026-500235 (2026-08-28), which is published as a bug fix update listing no CVEs. A complete Oracle Linux 9 x86_64 package manifest could not be retrieved for either erratum from the pages available, so the mapping from erratum to exact package version rests on Oracle’s per-CVE errata tables plus Swivel Secure’s direct observation of the installed version, rather than on a quoted package manifest. The version comparison itself was verified directly on the appliance.

GhostLock — CVE-2026-43499 

Relevant CVEs: CVE-2026-43499

Scanner Status: High (Local Privilege Escalation) — CVSS 3.1 base score 7.8

Appliance Status (Oracle Linux 9): Patched — update to kernel-uek 5.15.0-322.203.3.3 or later (Oracle ELSA-2026-50387).

Description

GhostLock is a Linux kernel local privilege escalation vulnerability in the real-time mutex / priority-inheritance futex code (kernel/locking/rtmutex.c). On the FUTEX_CMP_REQUEUE_PI rollback path the kernel operated on the wrong task structure, leaving a dangling pointer into a freed kernel stack frame (use-after-free). An unprivileged local user can exploit this to gain root.

The vulnerability cannot be triggered remotely — the attack vector is local (AV:L). An interactive session on the appliance as a non-root user is required before any exploit attempt can be made. No special privileges, capabilities, or user namespaces are needed, and the affected code path is present in all standard kernel builds.

Fix and Verification (Oracle Linux 9)

The fix is delivered by Oracle in the UEK R7 kernel kernel-uek-5.15.0-322.203.3.3.el9uek and later (Oracle ELSA-2026-50387). Apply it through the CMI: Administration → Update Appliance → Settings, ensuring external repositories are toggled (disable, then enable) and system packages are synchronised before running Update System, then reboot (a new kernel does not take effect until reboot). See “Updating the Appliance Kernel” above.

Confirm the running kernel via the CMI main menu → Version Information → Kernel Version. A value of 5.15.0-322.203.3.3 or higher confirms the fix is active.

Contextual Risk

Because exploitation requires an existing local shell, and AuthControl Sentry appliances do not expose general-purpose shell accounts to end users (administrative SSH access already carries full system privileges), the practical exposure is limited to scenarios where an attacker has already obtained a foothold on the host. Applying the kernel update removes the vulnerability entirely on Oracle Linux 9 appliances.

Note

Legacy CentOS 6 and CentOS 7 appliances (both end-of-life) are affected by GhostLock. Red Hat confirms the RHEL 6 and RHEL 7 kernels are affected, with fixes issued only under paid Extended Lifecycle Support (RHSA-2026:41920 for RHEL 6 ELS, RHSA-2026:41235 for RHEL 7 ELS). Community CentOS 6/7 rebuilds do not receive these updates, so no kernel patch is available for these platforms. As with all GhostLock exploitation, an interactive local shell is required; on these platforms the only available mitigation is the appliance’s restriction of shell access to privileged administrators. Customers on CentOS-based appliances should migrate to a supported Oracle Linux 9 appliance to obtain the fix.

Januscape — CVE-2026-53359 

Relevant CVEs: CVE-2026-53359

Scanner Status: Important — CVSS 3.1 base score 8.8

Appliance Status: Not Affected — the appliance does not use KVM host virtualization.

Description

Januscape is a use-after-free in the Linux kernel’s KVM x86 shadow-paging memory-management unit (arch/x86/kvm/mmu/mmu.c). It is a host-side hypervisor vulnerability: it can be exploited by an untrusted guest virtual machine to escape to the host (guest-to-host escape, in practice via nested virtualization), or as a local denial of service where /dev/kvm is world-accessible.

Why the Appliance is Not Affected

AuthControl Sentry appliances run as guest virtual machines (under VMware); they are not KVM hypervisor hosts and do not run nested guests. On all current appliance builds:

The KVM kernel modules (kvm, kvm_intel/kvm_amd) are not loaded.
The /dev/kvm device node does not exist.

The vulnerable KVM host code is therefore never activated at runtime, and neither the guest-to-host escape path nor the local /dev/kvm denial-of-service path is reachable. This is independent of the kernel version.

Verification

The absence of KVM host functionality can be confirmed by Swivel Secure Support; the vulnerable subsystem is inert on the appliance regardless of the installed kernel. No customer action is required.

Note

Legacy CentOS 6 and CentOS 7 appliances (both end-of-life) are likewise Not Affected. They too run as VMware guests with no KVM host functionality (KVM modules not loaded, /dev/kvm absent), so the vulnerable code is inert regardless of the platform being end-of-life. No patch is required on any appliance platform for this CVE.

ssh-keysign-pwn — CVE-2026-46333 

Relevant CVEs: CVE-2026-46333

Scanner Status: High (Local Privilege Escalation)

Appliance Status: Patched — upgrade to kernel-uek 5.15.0-320 or later (Oracle ELSA-2026-50280)

Description

CVE-2026-46333 is a Linux kernel local privilege escalation vulnerability published in May 2026. A race condition exists between exit_mm() and exit_files() in the kernel’s ptrace dumpability logic. When a privileged process exits, there is a brief window during which the dumpability check is skipped. An unprivileged local process can call pidfd_getfd(2) in this window and obtain a copy of a file descriptor from the exiting privileged process, potentially gaining access to sensitive resources.

The vulnerability cannot be triggered remotely. An active shell session on the appliance is required before any exploit attempt can be made.

Appliance Impact and Patch

AuthControl Sentry appliances running Oracle Linux 9 were affected on kernel-uek 5.15.0-303 (OL9.5) and 5.15.0-319 (OL9.7). Oracle released a patched kernel (5.15.0-320, advisory ELSA-2026-50280) on 2026-05-20. Swivel Secure verified the fix — the exploit no longer succeeds on kernel 5.15.0-320.

Two attack vectors were assessed:

ssh-keysign vector — blocked on all appliance builds by default. The OpenSSH EnableSSHKeysign directive is not set, so this path was never exploitable even on vulnerable kernels.
chage vector — the chage password expiry utility runs with elevated privileges. This path was open on vulnerable kernels and is closed by the kernel patch.

Contextual Risk Assessment

AuthControl Sentry appliances expose a single administrative shell account. Exploitation would require an attacker who already held admin credentials, which already confers full system access. The practical risk was low, but the patch should be applied.

Recommended Action

Apply the update via the System Update menu in the CMI. After updating and rebooting, verify the patched kernel is running via the CMI main menu by selecting Version Information — the Kernel Version field should show 5.15.0-320 or later.

If you experience any difficulty applying the update or confirming the kernel version, please raise a support ticket at supportdesk@swivelsecure.com.

Note

Legacy CentOS 6 and CentOS 7 appliances (both EOL) run kernel versions in the 2.6.x–3.10.x range, which predate the vulnerable code path entirely. No action is required on those platforms.

DirtyFrag — CVE-2026-43284 / CVE-2026-43500 

Relevant CVEs: CVE-2026-43284, CVE-2026-43500

Scanner Status: High (Local Privilege Escalation)

Appliance Status: Not Affected / CVE-2026-43284 formally patched in 5.15.0-320 (ELSA-2026-50261)

Description

DirtyFrag is a pair of Linux kernel local privilege escalation vulnerabilities discovered in May 2026. CVE-2026-43284 affects the IPsec ESP subsystem (esp4/esp6 modules) and CVE-2026-43500 affects the RxRPC subsystem.

By exploiting how in-place decryption operates over pipe-backed pages via splice() or sendfile(), an unprivileged local user can obtain a write primitive into the kernel page cache and escalate privileges to root.

The vulnerability cannot be triggered remotely. An active shell session on the host machine as a non-root user is required before any exploit attempt can be made.

Why the Appliance is Not Affected

Current AuthControl Sentry appliances running Oracle Linux 9 are not affected for two independent reasons, either of which is sufficient to prevent exploitation:

Kernel version is below the confirmed vulnerable range. Appliances currently ship with Oracle Unbreakable Enterprise Kernel R7 (5.15.0 branch). DirtyFrag has been confirmed exploitable on mainline kernel 6.12.0 and above. The UEK R7 branch predates the specific code paths targeted by published proof-of-concept exploits.
The vulnerable kernel modules are not loaded. The esp4, esp6, and rxrpc modules — which contain the vulnerable code — are not loaded on Swivel appliances. The appliance does not use IPsec or RxRPC functionality, so these modules are never activated at runtime.

Contextual Risk Assessment

Even in the absence of the above mitigations, the practical risk to customers is low. DirtyFrag requires an unprivileged shell account on the host machine as a starting point. AuthControl Sentry appliances do not expose general-purpose shell accounts to end users. Administrative SSH access is restricted to authorised personnel using username and password credentials, and that level of access already carries full system privileges — removing any incentive for a privilege escalation attack via this route.

Verification

Customers can confirm their appliance is running an unaffected kernel via the CMI main menu by selecting Version Information. On current CMI releases this shows a Kernel Version field; on older CMI releases the equivalent field may be labelled OS Version.

A value beginning with 5.15 confirms the appliance is running UEK R7 and is outside the confirmed vulnerable kernel range.

Note

Legacy CentOS 6 and CentOS 7 appliances (both EOL) run kernel versions in the 2.6.x–3.10.x range, which also predate the vulnerable code paths and do not load the relevant modules. No patches will be issued for EOL platforms; the exploitability assessment is the same as above and no customer action is required on those platforms either.

Fragnesia – CVE-2026-46300 / CVE-2026-43503 

Relevant CVEs: CVE-2026-46300, CVE-2026-43503

Scanner Status: High (Local Privilege Escalation) — CVSS 3.1 base score 7.8

Appliance Status: Patched — update to kernel-uek 5.15.0-320.202.8.5 or later (Oracle ELSA-2026-50287). Also mitigated by kernel build configuration — see below.

Description

Fragnesia is a Linux kernel local privilege escalation vulnerability disclosed in May 2026. It is closely related to DirtyFrag (above): the DirtyFrag patch left an adjacent flaw in the core socket-buffer code, which Fragnesia exploits.

The root cause is that skb_try_coalesce() failed to propagate the SKBFL_SHARED_FRAG marker when transferring paged fragments between socket buffers. Through the kernel’s ESP-in-TCP (espintcp) receive path, an unprivileged local user can cause page-cache pages belonging to a read-only file to be treated as ESP ciphertext and decrypted in place, yielding a controlled write into the page cache of a root-owned file (for example /usr/bin/su) and escalation to root.

The vulnerability cannot be triggered remotely. An active shell session on the host machine as a non-root user is required before any exploit attempt can be made.

Why the Appliance is Protected

Two independent factors apply to current AuthControl Sentry appliances running Oracle Linux 9:

The running kernel is patched. Oracle released the fix in kernel-uek 5.15.0-320.202.8.5 (advisory ELSA-2026-50287, 2026-05-25), which restores the SKBFL_SHARED_FRAG marker through the fragment-transfer and coalesce paths. Appliances updated to this build or later are not affected.
ESP-in-TCP is not compiled into the appliance kernel. The Oracle UEK R7 kernel shipped with the appliance is built with CONFIG_INET_ESPINTCP disabled. Both published Fragnesia proof-of-concept exploits require the espintcp receive path to deliver page-cache fragments into ESP input processing. With ESP-in-TCP absent from the kernel build, that entry point does not exist, independently of the running kernel version.

Note

Unlike DirtyFrag, the appliance is not protected here by the ESP modules being unloaded. esp4 and esp6 are present on disk and can be autoloaded, and unprivileged user namespaces are available. The protections that apply are the patched kernel and the absence of CONFIG_INET_ESPINTCP from the kernel build.

Contextual Risk Assessment

Fragnesia requires an unprivileged shell account on the host machine as a starting point. AuthControl Sentry appliances do not expose general-purpose shell accounts to end users. Administrative SSH access is restricted to authorised personnel using username and password credentials, and that level of access already carries full system privileges, removing any incentive for a privilege escalation attack via this route.

Recommended Action

Apply the update via the System Update menu in the CMI. After updating and rebooting, verify the patched kernel is running via the CMI main menu by selecting Version Information — the Kernel Version field should show 5.15.0-320.202.8.5 or later.

Verification

Administrators with shell access can additionally confirm the ESP-in-TCP path is absent from the running kernel:

grep CONFIG_INET_ESPINTCP /boot/config-$(uname -r)

Expected Output:

# CONFIG_INET_ESPINTCP is not set

Note

Legacy CentOS 6 and CentOS 7 appliances (both EOL) run kernel versions in the 2.6.x–3.10.x range. The ESP-in-TCP subsystem did not appear upstream until kernel 5.6, so the vulnerable code path is absent entirely on those platforms. No patches will be issued for EOL platforms and no customer action is required on them.

Bad Epoll – CVE-2026-46242 

Relevant CVEs: CVE-2026-46242

Scanner Status: High (Local Privilege Escalation) — CVSS 3.1 base score 7.8

Appliance Status: Not Affected — the vulnerable code path was never introduced into the appliance’s kernel branch

Description

Bad Epoll is a Linux kernel local privilege escalation vulnerability, disclosed publicly on 30 May 2026. It is a use-after-free in the kernel’s eventpoll (epoll) subsystem: on the ep_remove() path the kernel clears a file’s epoll back-reference while still using that file inside a lock-protected section, so a concurrent file-close (__fput()) can free the watched eventpoll object while it is still in use. By winning this race, an unprivileged local user can corrupt kernel memory and escalate privileges to root. A proof-of-concept has been published.

The vulnerability cannot be triggered remotely. An active shell session on the host machine as a non-root user is required before any exploit attempt can be made.

Why the Appliance is Not Affected

The flaw lives in the epoll reference-counting rework that was introduced upstream in the mainline Linux 6.4 kernel (April 2023); the upstream fix identifies that change as the origin of the bug. It was therefore not present in 5.15-era kernels as originally released.

Two points are important for understanding which 5.15 kernels are affected:

The rework was later backported into the mainline long-term-support (LTS) stable branches — into the 5.15.y series at 5.15.209 and the 6.1.y series at 6.1.175. Kernels at or above those points on the kernel.org stable trees carry the vulnerable code, which is why the CVE’s published affected range lists a 5.15.x entry despite the bug originating in 6.4.
Oracle’s Unbreakable Enterprise Kernel R7 — the kernel shipped with current AuthControl Sentry appliances on Oracle Linux 9 — is a separate distribution branch, forked from an early 5.15 release and maintained independently with its own version numbering (5.15.0-<build>.el9uek). It does not track the kernel.org 5.15.y stable series, and the epoll reference-counting rework was never brought into it. The vulnerable eventpoll removal path does not exist in the UEK R7 build, so the use-after-free cannot occur regardless of the running kernel version.

Whether a given 5.15 kernel is affected therefore depends on whether the specific introducing commit was backported into that particular branch — not on the 5.15 version number alone. It was backported into the kernel.org LTS tree; it was not backported into Oracle UEK R7.

This is corroborated by Oracle’s own advisories: Oracle has issued CVE-2026-46242 kernel fixes only for Unbreakable Enterprise Kernel R8 (the 6.12 branch — advisories ELSA-2026-50372 and ELSA-2026-500150) and for the Red Hat Compatible Kernel (ELSA-2026-36645). No fix has been issued for UEK R7, because the vulnerable code was never present in that branch. Swivel appliances run the Unbreakable Enterprise Kernel exclusively; the Red Hat Compatible Kernel is not installed.

Why Scanners May Flag This

Vulnerability scanners perform version-based CVE matching: they compare the installed kernel version against the CVE’s published affected range and flag accordingly. Because that range includes a 5.15.x entry (from the mainline LTS backport described above), a scanner may match the appliance’s 5.15.0-<build>.el9uek kernel purely on its version number and report it as vulnerable.

This is a false positive. The scanner matches a version string; it does not verify whether the introducing commit is present in the specific kernel branch. Oracle UEK R7 uses independent version numbering forked from an early 5.15 release and does not track the mainline stable 5.15.y series, so the appliance’s 5.15.0 version does not correspond to the affected mainline 5.15.209 code at all. No remediation is required.

Contextual Risk Assessment

Even in the absence of the above, Bad Epoll requires an unprivileged shell account on the host machine as a starting point. AuthControl Sentry appliances do not expose general-purpose shell accounts to end users. Administrative SSH access is restricted to authorised personnel using username and password credentials, and that level of access already carries full system privileges, removing any incentive for a privilege escalation attack via this route.

Verification

Customers can confirm their appliance is running an unaffected kernel via the CMI main menu by selecting Version Information. On current CMI releases this shows a Kernel Version field; on older CMI releases the equivalent field may be labelled OS Version.

A value of the form 5.15.0-<build>.el9uek confirms the appliance is running Oracle UEK R7, in which the vulnerable eventpoll code path is absent.

Note

The bare major version 5.15 is not on its own a guarantee of safety on general-purpose Linux systems: mainline kernel.org LTS 5.15.y kernels at 5.15.209 or later did receive the backported vulnerable code. The appliance is unaffected because it runs the Oracle UEK R7 branch (…el9uek) specifically, not the mainline 5.15.y stable series.

Note

Legacy CentOS 6 and CentOS 7 appliances (both EOL) run kernel versions in the 2.6.x–3.10.x range, which predate the affected epoll code entirely. The exploitability assessment is the same as above and no customer action is required on those platforms.

Copy Fail – CVE-2026-31431 

Relevant CVEs: CVE-2026-31431

Scanner Status: High (Local Privilege Escalation)

Appliance Status: Not Affected / Formally patched in 5.15.0-320 (ELSA-2026-50261)

Description

Copy Fail is a Linux kernel local privilege escalation vulnerability disclosed in April 2026. It is a logic bug in the authencesn cryptographic template within the kernel’s algif_aead module, the AEAD socket interface of the userspace crypto API (AF_ALG).

By exploiting the flaw, an unprivileged local user can trigger a deterministic 4-byte write into the page cache of any readable file on the system, including setuid binaries, and escalate privileges to root. Unlike many kernel exploits, Copy Fail does not require a race condition and can be triggered reliably. A proof-of-concept exploit of 732 bytes has been published that achieves root on a wide range of Linux distributions.

The vulnerability cannot be triggered remotely. An active shell session on the host machine as a non-root user is required before any exploit attempt can be made.

Why the Appliance is Not Affected

The algif_aead module, which provides the exploitable interface, is not present in the Oracle Unbreakable Enterprise Kernel R7 build shipped with AuthControl Sentry appliances. The module does not exist on disk and therefore cannot be loaded. Without it, the exploit has no entry point regardless of the running kernel version.

Why Scanners May Flag This

Vulnerability scanners perform version-based CVE matching: they compare the installed kernel version against the known vulnerable range for the CVE and flag accordingly. Copy Fail affects kernels released since 2017, so any 5.15.x kernel will be flagged automatically.

However, scanners do not verify whether the specific vulnerable module is present in a given kernel build. Oracle’s UEK R7 kernel is not built with algif_aead included, meaning the attack surface does not exist on the appliance. This is a false positive and no remediation is required.

Contextual Risk Assessment

Even in the absence of the above, Copy Fail requires an unprivileged shell account on the host machine as a starting point. AuthControl Sentry appliances do not expose general-purpose shell accounts to end users. Administrative SSH access is restricted to authorised personnel using username and password credentials, and that level of access already carries full system privileges, removing any incentive for a privilege escalation attack via this route.

Verification

Customers can confirm their appliance kernel via the CMI main menu by selecting Version Information. On current CMI releases this shows a Kernel Version field; on older CMI releases the equivalent field may be labelled OS Version.

A value beginning with 5.15 confirms the appliance is running UEK R7, in which the algif_aead module is absent from the kernel build.

Note

Legacy CentOS 6 and CentOS 7 appliances (both EOL) also do not have the algif_aead module present on disk. The exploitability assessment is the same as above and no customer action is required on those platforms.

ELSA-2025-20114: NetworkManager Dispatcher Permissions 

Relevant CVEs: CVE-2025-20114 (and related)

Scanner Status: Critical / High

Appliance Status: Safe / Mitigated

Description

A vulnerability exists in NetworkManager where the dispatcher directory may have incorrect permissions (777), potentially allowing local privilege escalation.

Why this is a False Positive

Vulnerability scanners flag this based on the installed RPM version of NetworkManager (e.g., versions prior to 1.48.10-5.0.3). However, Swivel Secure appliances enforce the correct file permissions via configuration management, regardless of the RPM version installed. The security risk is neutralized by restricting filesystem access.

Verification of Mitigation

You can verify the appliance is secure by checking the directory permissions. Access the appliance command line and run:

ls -ld /etc/NetworkManager/dispatcher.d

Expected Output:

The output must show drwxr-xr-x (755). If the output shows drwxrwxrwx (777), please contact support immediately.

drwxr-xr-x. 2 root root 4096 Dec 9 10:00 /etc/NetworkManager/dispatcher.d

CVE-2024-38541: Kernel ‘of_modalias’ Buffer Overflow 

Relevant CVEs: CVE-2024-38541

Scanner Status: High / Medium

Appliance Status: Not Affected

Description

A buffer overflow vulnerability exists in the Linux kernel’s of_modalias() function. This function is part of the Device Tree (Open Firmware) subsystem, used primarily by embedded architectures (like ARM) to describe hardware components.

Why this is a False Positive

Swivel Secure appliances on x86_64 hardware utilize ACPI for hardware discovery, not Device Trees. The vulnerable subsystem is strictly controlled by the kernel configuration flag CONFIG_OF.

On this appliance, this feature is disabled at compile time. This means the vulnerable code is not present in the kernel binary and cannot be executed, rendering the appliance immune to this specific vulnerability.

Verification

You can prove the vulnerable subsystem is not present by checking the running kernel’s build configuration.

grep "CONFIG_OF" /boot/config-$(uname -r)

Expected Output

The command should return no output (or explicitly state is not set), proving the “module” is not active.

# CONFIG_OF is not set

Samba Command Injection — CVE-2026-4408 / CVE-2026-4480 

Relevant CVEs: CVE-2026-4408, CVE-2026-4480

Scanner Status: Critical — CVSS 3.1 base score 9.0 for both (Oracle CVE-2026-4408, Oracle CVE-2026-4480)

Appliance Status: Not Affected — Samba is not installed on the appliance.

Description

Both CVEs are remote command execution flaws in Samba, caused by failing to escape shell metacharacters in client-controlled strings before passing them to a configured shell command:

CVE-2026-4408 — the check password script feature, when configured with the %u substitution, passes a client-controlled username to the script without escaping. Oracle notes this primarily affects non-standard configurations with samba-dcerpcd running as a system service.
CVE-2026-4480 — the Samba printing subsystem passes a client-supplied print job description to the configured print command via the %J substitution without escaping.

Both require a running Samba server with the relevant feature configured.

Why the Appliance is Not Affected

AuthControl Sentry appliances do not install or run Samba. Verified on 2026-09-04 on an Oracle Linux 9.8 appliance:

No samba package of any kind is installed.
The Samba server binary /usr/sbin/smbd does not exist.
Nothing is listening on the SMB ports. The appliance’s complete set of listening TCP sockets is 22 (sshd), 3306 (mariadbd), 8080 and 8443 (Tomcat), plus 8181 bound to localhost only.

Neither the check password script nor the print command setting exists on the appliance, because the software that reads them is not present. The vulnerable code is absent rather than merely unreachable, and this is independent of package versions.

Why Scanners Report It Anyway

Scanners flag these CVEs against libldb, which is installed. libldb is an LDAP-like embedded database library distributed alongside Samba, and on the appliance it is present only as a dependency of sssd-common — confirmed with rpm -q --whatrequires libldb. It is not the fixed package: Oracle’s errata for both CVEs list samba as the package to update, and no libldb update is issued for either. Attributing a Samba server CVE to libldb does not indicate that the vulnerable code path is installed — the daemon that contains it, smbd, is absent.

Independently of the above, libldb was observed mapped by zero running processes at the time of verification.

Verification

The absence of Samba can be confirmed by Swivel Secure Support. No customer action is required for either CVE.

net-snmp Trap Daemon Buffer Overflow — CVE-2025-68615 

Relevant CVEs: CVE-2025-68615

Scanner Status: Critical — CVSS 3.1 base score 9.8 (Oracle CVE-2025-68615)

Appliance Status: Patched — the appliance’s net-snmp packages already include the fix. SNMP is a supported appliance feature and is not enabled by default, so appliances that have not enabled it were never exposed.

Description

A specially crafted packet sent to the snmptrapd daemon causes a buffer overflow and crashes the daemon. The flaw affects net-snmp before 5.9.5 and 5.10.pre2. Oracle rates it CVSS 9.8. The vulnerable component is specifically the SNMP trap receiver daemon snmptrapd — not the net-snmp libraries in general, and not the SNMP agent snmpd.

SNMP on the Appliance

SNMP monitoring is a supported capability of the AuthControl Sentry appliance. The net-snmp packages are part of the appliance so that SNMP can be turned on when a customer’s monitoring infrastructure requires it, and SNMP is configured through the CMI. It is not enabled by default: on an appliance where SNMP has not been configured, neither snmpd nor snmptrapd is running and nothing is listening on the SNMP ports.

Verified on 2026-09-04 on an Oracle Linux 9.8 appliance with SNMP not configured: both the snmpd and snmptrapd services were disabled, and the appliance’s complete set of listening TCP sockets was 22 (sshd), 3306 (mariadbd), 8080 and 8443 (Tomcat), plus 8181 bound to localhost only.

Fix and Verification (Oracle Linux 9)

Oracle issued the Oracle Linux 9 fix in ELSA-2026-0696 (2026-01-15), and current appliance package versions include it. The version observed on the appliance (net-snmp-5.9.1-21.0.1.el9, with matching net-snmp-libs and net-snmp-agent-libs) exceeds the fixed version named by the scanner for this CVE.

Apply appliance updates through the CMI as described in “Updating the Appliance Kernel” above. Where SNMP is in use, restart the SNMP services (or reboot) after updating so that the running daemon is the patched one.

Contextual Risk

For customers using SNMP, package currency is the control that matters: an SNMP trap receiver is network-reachable by design, so an appliance running an unpatched snmptrapd could be crashed by a crafted packet. The impact described upstream is a daemon crash — a denial of service of the SNMP trap receiver — rather than compromise of the appliance or of authentication services.

As with any monitoring service, Swivel Secure recommends restricting access to the SNMP ports to the customer’s monitoring infrastructure rather than exposing them broadly.

OpenSSH Client Use-After-Free on Re-Key — CVE-2026-60002 

Relevant CVEs: CVE-2026-60002

Scanner Status: Critical (as reported by AWS Inspector) — Oracle rates this Important, CVSS 3.1 base score 7.7 (Oracle CVE-2026-60002)

Appliance Status: Patched — resolved by the current openssh packages delivered through the CMI. The vulnerable role is in any case the SSH client, not the SSH server the appliance exposes.

Description

A use-after-free occurs in ssh when a server changes its host key during a key re-exchange. The flaw affects OpenSSH before 10.4. Oracle’s advisory states explicitly that the outcome “occurs only on the client side” — that is, the vulnerable code runs in the outbound SSH client process, and is triggered by a malicious or compromised server that the client connects to.

Why the Appliance’s Exposure is Limited

The appliance exposes an SSH server (sshd) on port 22 for administrative access. This CVE is not a flaw in sshd, and it cannot be triggered by a client connecting to the appliance. Exploitation requires the appliance to initiate an outbound SSH connection to a server under an attacker’s control, and for that server to change its host key mid-session.

Outbound SSH from the appliance is not part of normal AuthControl Sentry operation; it occurs only where an administrator initiates it. An attacker who is already able to direct an appliance administrator to connect to a hostile SSH server, and to intercept or control that server’s host key, has a stronger position than this vulnerability provides.

Fix and Verification (Oracle Linux 9)

Oracle issued the Oracle Linux 9 fix in ELSA-2026-47756 (2026-08-06). Swivel Secure verified on 2026-09-04 that after a CMI system update the installed OpenSSH packages (openssh, openssh-clients, openssh-server at 9.9p1-9.0.3.el9_8) exceed the fixed version named by the scanner for this CVE. Oracle’s CVE page identifies the fixing erratum but does not publish the fixed package version in a form that can be quoted here.

Appliances that have not yet taken the update will continue to be flagged — an appliance observed on 2026-09-04 prior to updating carried openssh-9.9p1-7.0.2.el9_8, which predates the fix. Apply the update through the CMI as described in “Updating the Appliance Kernel” above. A new OpenSSH package takes effect for new connections once the sshd service has been restarted; if in doubt, reboot the appliance.

Contextual Risk

Because the flaw is client-side, an unpatched appliance is not remotely exploitable by anyone connecting to it. The practical risk is confined to administrator-initiated outbound SSH sessions to untrusted servers.

PHP Remote Code Execution – CVE-2026-109618 / CVE-2026-109619 

Relevant CVEs: CVE-2026-109618 (RCE via OOM corruption), CVE-2026-109619 (RCE via stale global state)

Scanner Status: Critical (Remote Code Execution) – CVSS 4.0 base score 9.2 for both CVEs, as given in the PHP project advisories (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp)

Appliance Status: Not Affected on the appliance images Swivel Secure has checked. No PHP package, binary, service or process was found on them. See “Verification” below for exactly which images were checked and which have not been.

Description

Two critical vulnerabilities in the PHP interpreter were announced by the PHP project on 21 October 2026 (announcement). Both can allow unauthenticated remote code execution on a server that runs PHP to serve web requests.

CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialised, and request cleanup may then treat the invalid data as valid.

CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialisation resets it.

The PHP advisories list PHP versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected, and those four releases as the fixed versions.

CISA states that it “has not observed exploitation of these vulnerabilities as of the time of publication” (CISA alert). CERT-EU states that “initial proofs of concept (PoCs) have begun to circulate”, which “raises the likelihood that attackers are already exploiting the vulnerabilities” (CERT-EU advisory). Anyone who runs PHP should treat patching as urgent.

Why the Appliance is Not Affected

These vulnerabilities are in the PHP interpreter. The appliance runs its applications on Java under Tomcat and does not use PHP. On the images listed below, no PHP package is installed, no PHP binary or service exists, and no PHP process is running. With no PHP present there is nothing for either vulnerability to act on.

Verification

Swivel Secure checked the appliance images below. On each one the installed package list was searched for PHP packages, the system was searched for PHP binaries and PHP-named files, and the running processes and services were checked. No PHP package, binary, service or process was found. The only PHP-related files are the inert Webmin files described below.

Oracle Linux 9.8 appliances. These run the Oracle Unbreakable Enterprise Kernel (UEK R7), kernel version 5.15.0.
CentOS 7 appliances. These run kernel version 3.10.0.
CentOS 6.10 appliances. These run kernel version 2.6.32.

To see which of these your appliance is, open the CMI main menu and select Version Information. The operating system and kernel version shown there (the field is labelled Kernel Version on current CMI releases and OS Version on older releases) begin with the numbers above. The final digits of the kernel version change each time the appliance is updated, so only the leading part, such as 5.15.0, 3.10.0 or 2.6.32, identifies the family.

Webmin and the “PHP Configuration” module

Appliances based on CentOS 6 and CentOS 7 include Webmin, a system administration package. Webmin is installed but not running, because its service is disabled, and nothing listens on port 10000. Webmin does not use PHP. Deeper scans can flag it because it includes a standard module called “PHP Configuration” (phpini), which is an editor for php.ini settings. The module consists of script files and configuration files, and it does not contain or install a PHP interpreter. No PHP interpreter is installed on any of the appliances checked, so the module has nothing to edit and nothing to run.

A file search of these appliances will also list six files ending in “.php” in the Webmin directory (/usr/libexec/webmin/file/xinha and /usr/libexec/webmin/mailboxes/xinha): php-xinha.php, ext_example-dest.php and ext_example-menu.php in each. These are sample and helper files supplied with a third-party editor component bundled in the Webmin package. They cannot run, because there is no PHP interpreter on the appliance. Their presence does not mean PHP is installed, and CVE-2026-109618 and CVE-2026-109619 cannot be reached through them.

Contextual Risk

PHP applications that you run alongside the appliance, on separate servers outside it, are not covered by this entry and are not made safe by it. If you run your own PHP applications, patch PHP on those servers to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (whichever matches your PHP branch). If you run a different PHP branch, follow the guidance of the PHP project or your operating system vendor. This is separate from the appliance and no appliance update is involved. The PHP project states that configuration measures only reduce exposure to specific attack paths and that updating is the only complete solution.

Node2Shell CVE-2026-111497 

Relevant CVEs: CVE-2026-111497

Scanner Status: High

Appliance Status: Not Affected

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Why the Appliance is Not Affected

None of Swivel Secure’s products use node.js. Therefore, they are not vulnerable to this CVE.

Java vulnerability to weak intermediate certificates 

Relevant CVEs: CVE-2026-91403

Scanner Status: Critical

Appliance Status: Affected

Description

A number of intermediate signing certificates were generated by one source which were cryptographically weak and easily replicable. This made it possible for bad actors to sign certificates using these certificates. While all major browsers have been updated to reject these certificates, Java applications such as ours rely on their own internal blacklists.

It should be noted that this only affects outgoing network connections from appliances, not incoming requests.

Action Required

Swivel Secure has produced a new custom build of Java 1.8.0_504, with the blacklist updated to include these deprecated certificates.

Note that, because we have changed the way Java is installed on our appliances, to ensure that older versions are correctly removed, this new version cannot be seen without first installing an update to the CMI. Please see Technical Notes for instructions on installing.

If you have an older appliance (i.e. CentOS rather than Oracle Linux), this update is not available. We recommend updating to a new appliance, but if that is not immediately possible, please contact Swivel Secure support for alternative solutions.

Last reviewed 2026-10-26