---
id: "CVE-2026-63243"
kind: "vulnerability"
aliases: ["CVE-2026-63243"]
title: "Creative Sound Blaster Katana: Bluetooth LE flaw allows connection without pairing"
severity: "medium"
cvss: 4.3
epss: 0.00261
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bluetooth", "creative", "infrastructure", "iot", "sound-blaster-katana"]
not_affected_if: ["bluetooth-disabled"]
published_at: "2026-10-23T07:16:38+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:37:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63243", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-63243", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Creative Sound Blaster Katana: Bluetooth LE flaw allows connection without pairing

The Bluetooth Low Energy implementation of the Creative Sound Blaster Katana speaker bar accepts connections without prior pairing or authentication. An attacker within Bluetooth range can connect to an affected device without credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether a Creative Sound Blaster Katana device is in use, and note its firmware version, which the sources do not state
- unknown for any other check, as the sources do not say how to test exposure

## Fix

- unknown: the sources do not name a fixed firmware version or vendor update
- Check Creative's support pages for a firmware update for the Sound Blaster Katana

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63243
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-63243

## From the sources

An
authentication vulnerability in the Bluetooth Low Energy (BLE) implementation
of Creative Sound Blaster Katana could allow an attacker within Bluetooth range
to connect to an affected device without prior pairing or authentication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_