CVE-2026-109813: Shared Hard-coded Root CA Private Key

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-16
Weakness: CWE-321

Description

A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

Affected products

Moxa AIG-302 Series: from 1.0.0 through 1.4.0

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products

Get alerted when CVE-2026-109813 or the next vulnerability affects your stack