PT-2026-51609 · Unknown · Caliptra Core Runtime Firmware

CVE-2026-5818

·

Published

2026-06-23

·

Updated

2026-06-25

CVSS v4.0

7.2

High

VectorAV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions Caliptra Core Runtime Firmware versions 2.0.0 through 2.0.1 Caliptra Core Runtime Firmware version 2.1.0
Description An incorrect check of a function return value within the ActivateFirmwareCmd::activate fw modules allows the bypass of the verification process for the MCU firmware during a hitless update. A hitless update is a process that allows updating software without interrupting the system's operation.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-253

Related Identifiers

CVE-2026-5818
GHSA-456R-GCJR-6RXQ

Affected Products

Caliptra Core Runtime Firmware