PT-2026-26039 · Unknown · Link Aggregation

Gabriele Quagliarella · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-22323

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Versions prior to patchday 2026-05 (affected versions not specified)

Description A Cross-Site Request Forgery (CSRF) issue exists in the Link Aggregation configuration interface. An unauthenticated remote attacker can deceive authenticated users into submitting unauthorized POST requests to the device. This manipulation can silently modify the device’s configuration without the user’s awareness or permission. The impact on availability is considered low, as the device automatically recovers after a successful attack without requiring external intervention.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-22323

Affected Products

Link Aggregation

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-22323 · Security Note
• https://twitter.com/VulmonFeeds/status/2034219520332558385 · Twitter Post
• https://twitter.com/CVEnew/status/2034365310263075109 · Twitter Post
• https://certvde.com/de/advisories/VDE-2025-104 · Note
• https://twitter.com/RedPacketSec/status/2034209842525614524 · Twitter Post
• https://twitter.com/cyberbivash/status/2034190280816001192 · Twitter Post