SearchSubscribe

TRA-2026-39

Pre-auth stack overflow in SSL VPN portal

An oversized client certificate field overflows a fixed buffer in the portal daemon before authentication.

  • Patched
  • Network devices

CVSS 3.1 base score

9.8critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor
Corvane Networks
Product
Corvane SecureGate 7
CVE
  • CVE-2026-37455
Disclosure
99 days
Researchers
Yuki Tanaka, Marta Kowalczyk

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Corvane SecureGate 77.0 – 7.4.37.4.4

Read the research

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

An oversized client certificate field overflows a fixed buffer in the portal daemon before authentication.

Proof of concept

Tenable has shared a proof of concept with Corvane Networks. It is not published here, to give operators time to apply the fix.

Solution

Upgrade to 7.4.4 or later. Until then, disable client certificate authentication on internet-facing portals.

Disclosure timeline

  1. Tenable reports the issue to Corvane Networks

  2. TRA-2026-39 published

99 days from report to publication, against a 90-day policy.How we disclose