CVE-2026-78135: Strongswan

High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days.

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.

Affected products

• Strongswan Strongswan: from 5.9.7, up to and including 6.0.7

Published 2026-09-11. Last modified 2026-09-16.