Live › vulnerability › CVE-2026-66279
Go to dashboardConnect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier accept a message with invalid security settings that can get past authentication. An attacker can use it to disrupt network traffic, but the sources say it does not expose the Network Key or break confidentiality.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams whose applications embed Connect SDK 4.3.1 or earlier, or Flex SDK 3.7.7 or earlier, and accept messages from a network source. The sources do not describe the exact message path or configuration that makes an application reachable. Teams not using either SDK can skip it.
No product ranges from the sources yet.
4.3.1 and the Flex SDK version against 3.7.7, in the project's dependency manifest or lockfile4.3.13.7.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.
This page as .md · .json · in your agent: get_signal("CVE-2026-66279")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.