CVE-2026-21383: Reusing a Nonce, Key Pair in Encryption in HLOS

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-06 · updated 2026-10-25
Weakness: CWE-323

Description

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

Affected products

Qualcomm Fastconnect 6900 Firmware: all versions
Qualcomm Fastconnect 7800 Firmware: all versions
Qualcomm Lemans Au Lgit Firmware: all versions
Qualcomm Lemansau Firmware: all versions
Qualcomm Pandeiro Firmware: all versions
Qualcomm Qam8255P Firmware: all versions
Qualcomm Qam8397P Firmware: all versions
Qualcomm Qam8797P Firmware: all versions
Qualcomm Qamsrv1H Firmware: all versions
Qualcomm Qamsrv1M Firmware: all versions
Qualcomm Qca6595Au Firmware: all versions
Qualcomm Qca6696 Firmware: all versions
Qualcomm Qca6698Aq Firmware: all versions
Qualcomm Qca6797Aq Firmware: all versions
Qualcomm Qca8695Au Firmware: all versions
Qualcomm Qdu1000 Firmware: all versions
Qualcomm Qdu1110 Firmware: all versions
Qualcomm Qdu1210 Firmware: all versions
Qualcomm Qdx1010 Firmware: all versions
Qualcomm Qdx1011 Firmware: all versions
Qualcomm Qln1083Bd Firmware: all versions
Qualcomm Qln1086Bd Firmware: all versions
Qualcomm Qpa1083Bd Firmware: all versions
Qualcomm Qpa1086Bd Firmware: all versions
Qualcomm Dragonwing X100 Accelerator Card Firmware: all versions
Qualcomm Qxm1093 Firmware: all versions
Qualcomm Qxm1094 Firmware: all versions
Qualcomm Qxm1095 Firmware: all versions
Qualcomm Qxm1096 Firmware: all versions
Qualcomm Sa7255P Firmware: all versions

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html

Get alerted when CVE-2026-21383 or the next vulnerability affects your stack