CVE-2026-19538
Medium
Elevated severity or exploit probability.
CVSS base
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS — probability of exploitation (30 days)
0.3%
23.1th percentile
CISA KEV
Not listed
Weakness / dates
CWE-290
Published 2026-08-26 · modified 2026-09-08
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | N | None |
| Integrity | H | High |
| Availability | N | None |
Timeline
- 2026-08-26 — Published (NVD)
- 2026-09-08 — Last modified (NVD)
Description
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.