Medium severity · published Aug 13, 2026
CVE-2026-72506
VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server (or service) controlled by an attacker, potentially resulting in the theft of input data or the display of incorrect results.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VT
"VoiceTra(Voice Translator)" for Android · National Institute of Information and Communications Technology
9.1.3 through 9.2.0 · source: vendor
VT
"VoiceTra(Voice Translator)" for iOS · National Institute of Information and Communications Technology
9.1.3 through 9.2.0 · source: vendor
Affected product
VT
"VoiceTra(Voice Translator)" for Android
National Institute of Information and Communications Technology