CVE-2026-25998

CVE-2026-25998 is a critical vulnerability in strongMan, the management interface for strongSwan VPN, affecting versions prior to 0.2.0. It stems from improper encryption of stored credentials, where a global key and non-unique initialization vectors (IVs) were used, leading to the reuse of encryption key streams. An attacker with database access can exploit this flaw to decrypt sensitive information like private keys and EAP secrets by leveraging publicly available encrypted certificates. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high confidentiality impact, requiring no user interaction or privileges. The primary impact is the complete compromise of stored credentials. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.