CVE-2026-18796CWE-1342

CVE-2026-18796

published September 7, 2026

CVSS

6.8

EPSS

Percentile

0.1

In the wild

Unconfirmed

What it is

Any application that

uses external QSPI flash for encrypted XIP on nRF5340 and relies on that

encryption for confidentiality and/or integrity of the externally stored

code. No specific nRF Connect SDK version is the root cause; the weakness

is in the on-the-fly decryption scheme.

The record

Technical detail

CVSS: 6.8 · NONE
CVSS v4.0: 6.8 · CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
EPSS: 0.00079 · 0.1th percentile
Weakness: CWE-1342 · Information Exposure through Microarchitectural State after Transient Execution
Published: 2026-09-07T13:17Z

References (1)

EPSS history

Timeline