CVE-2026-95699CWE-653

CVE-2026-95699

Critical · published September 25, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:H
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-653 · Improper Isolation or Compartmentalization
Published
2026-09-25T01:18Z
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json · [email protected]https://www.mrsteam.com/contactus/ · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 20:39Z
    MrSteam iSteamX Improper Isolation or Compartmentalization
    cvelistv5