High severity · published Sep 29, 2026
CVE-2026-102760
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP
8.3
CVSS
0.2%
EPSS
No
On KEV
Description
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ND
NetX Duo · Eclipse Foundation
6.0 through 6.5.1.202602 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102760
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102760
github.com
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8w5x-ff58-2fr2
More from NetX Duo
9.3
CVE-2026-103415
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet
9.3
CVE-2026-102761
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the…
8.8
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size
8.8
CVE-2026-102712
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the…
8.7
CVE-2026-106465
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns