Skip to content
CVE-2026-129126 in C-Kermit Exposes Servers to Remote Compromise

CVE-2026-129126 in C-Kermit Exposes Servers to Remote Compromise

First seen 14 Nov 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 15:43 UTC
  • •CVE-2026-129126 is a critical heap buffer overflow vulnerability in C-Kermit.
  • •Affected versions are prior to 11.1.515, with a CVSS score of 9.2.
  • •Mitigation includes upgrading to the fixed version and restricting access to trusted peers.

C-Kermit versions prior to 11.1.515 contain a heap buffer overflow vulnerability (CVE-2026-129126) in the putsrv() function, allowing attackers to send crafted packets that can overwrite memory beyond the srvcmd buffer. This vulnerability affects servers and receiving instances, enabling potential remote compromise without user interaction. The CVSS score for this vulnerability is 9.2, indicating a risk. Currently, there is no evidence of active exploitation, but the risk remains significant for internet-reachable or partner-accessible file-transfer hosts. Mitigation strategies include upgrading to the patched version and restricting access to trusted peers until a fix is applied. The vulnerability was published on November 13, 2026, and is due to its potential impact on confidentiality, integrity, and availability of affected systems. Security professionals are advised to monitor for unusual packet patterns and service anomalies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-11-13
CVE-2026-129126 published
CVE-2026-129126 was disclosed, detailing a critical heap buffer overflow in C-Kermit.
Sploitus
2026-11-14
CVE-2026-129126 alert issued
Redpacketsecurity issued an alert regarding the critical vulnerability and its potential impacts.
Redpacketsecurity

More articles in this cluster (4)

Following this threat?

Track CVE-2026-129126 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 3

Common questions

What versions of C-Kermit are affected?
C-Kermit versions prior to 11.1.515 are affected by this vulnerability.
Is there any active exploitation of this vulnerability?
Currently, there is no evidence of active exploitation reported.
What should organizations do to mitigate this risk?
Organizations should upgrade to the fixed version of C-Kermit and restrict access to trusted peers until the patch is applied.