CVE-2026-18796

medium F5
CVSS v3 Base Score
6.8
CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
EPSS Score
0.1%
Exploitation probability in 30 days
Top 100% most likely to be exploited
Attack Characteristics
Attack Vector
Physical
Attack Complexity
High
Privileges Required
None
User Interaction
None
Published: September 7, 2026 (3 days ago)
Last Modified: September 10, 2026
Vendor: F5
Source: MITRE

Description

Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme.

CWE

CWE-1342

Affected Products

Nordic Semiconductor ASA nRF5340

References

🔗 docs.nordicsemi.com