{"id":"CVE-2026-63243","kind":"vulnerability","aliases":["CVE-2026-63243"],"related":[],"title":"Creative Sound Blaster Katana: Bluetooth LE flaw allows connection without pairing","description":"An\nauthentication vulnerability in the Bluetooth Low Energy (BLE) implementation\nof Creative Sound Blaster Katana could allow an attacker within Bluetooth range\nto connect to an affected device without prior pairing or authentication.","summary":"The Bluetooth Low Energy implementation of the Creative Sound Blaster Katana speaker bar accepts connections without prior pairing or authentication. An attacker within Bluetooth range can connect to an affected device without credentials.","severity":"medium","cvss":4.3,"epss":0.00261,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","creative","infrastructure","iot","sound-blaster-katana"],"not_affected_if":["bluetooth-disabled"],"how_to_check":"- Confirm whether a Creative Sound Blaster Katana device is in use, and note its firmware version, which the sources do not state\n- unknown for any other check, as the sources do not say how to test exposure","fix":"- unknown: the sources do not name a fixed firmware version or vendor update\n- Check Creative's support pages for a firmware update for the Sound Blaster Katana","status":"open","published_at":"2026-10-23T07:16:38+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:37:22+00:00","updated_at":"2026-10-25T04:37:22+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:37:22Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed firmware version or vendor update\n- Check Creative's support pages for a firmware update for the Sound Blaster Katana","reach":"network","title":"Creative Sound Blaster Katana: Bluetooth LE flaw allows connection without pairing","impact":"medium","summary":"The Bluetooth Low Energy implementation of the Creative Sound Blaster Katana speaker bar accepts connections without prior pairing or authentication. An attacker within Bluetooth range can connect to an affected device without credentials.","category":"infrastructure","nicknames":[],"who_cares":["creative","sound-blaster-katana","bluetooth","iot"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker connects over Bluetooth without pairing and may control the device","analyst_note":"Find the vendor advisory from Creative and the affected and fixed firmware versions, and confirm what an attacker can do after connecting.","how_to_check":"- Confirm whether a Creative Sound Blaster Katana device is in use, and note its firmware version, which the sources do not state\n- unknown for any other check, as the sources do not say how to test exposure","needs_analyst":true,"not_affected_if":["bluetooth-disabled"],"who_is_affected":"Teams or people who use a Creative Sound Blaster Katana with Bluetooth enabled are exposed, since the flaw is in its BLE implementation. Devices with Bluetooth turned off or not in use in a shared space are not reachable over the air. The sources do not say which firmware versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3346,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63243':14A,17A 'accept':39B 'affect':55B,85C 'allow':8A,75C 'attack':47B,77C 'authent':45B,60C,91C 'bar':38B 'blaster':3A,24B,35B,72C 'ble':67C 'bluetooth':5A,18B,27B,49B,64C,79C 'connect':9A,40B,52B,82C 'could':74C 'creativ':1A,19B,33B,70C 'credenti':58B 'cve':12A,15A 'devic':56B,86C 'energi':29B,66C 'flaw':7A 'implement':30B,68C 'infrastructur':20B 'iot':21B 'katana':4A,25B,36B,73C 'le':6A 'low':28B,65C 'pair':11A,43B,89C 'prior':42B,88C 'rang':50B,80C 'sound':2A,23B,34B,71C 'sound-blaster-katana':22B 'speaker':37B 'vulner':61C 'within':48B,78C 'without':10A,41B,57B,87C","nicknames":[],"mitigations":[],"who_affected":"Teams or people who use a Creative Sound Blaster Katana with Bluetooth enabled are exposed, since the flaw is in its BLE implementation. Devices with Bluetooth turned off or not in use in a shared space are not reachable over the air. The sources do not say which firmware versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T07:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63243","severity":null,"published_at":"2026-10-23T07:16:38+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-63243","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63243","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}