RADIUS identity CVEs
Blast-RADIUS is a protocol-level Access-Accept forge. MFA that sits behind RADIUS without Message-Authenticator is optional.
How this protocol fails
RADIUS still fronts VPN, Wi-Fi, and a surprising amount of MFA. A chosen-prefix MD5 collision on the Response Authenticator lets an on-path attacker turn Reject into Accept. Vendor patching ran into 2026. This is not a single-product bug. It is every NAS that still speaks RFC 2865 without Message-Authenticator or RadSec.
What security people should do
- Require Message-Authenticator on every client and server. Reject packets that omit it.
- Move to RadSec (RADIUS over TLS) where the NAS supports it.
- Stop sending PAP/CHAP across a network you do not trust.
- Inventory MFA products that still front RADIUS. A phishing-resistant factor behind a forgeable Accept is not phishing-resistant.
CVEs in this category
Showing 2 of 2
- CVE-2026-76460critical 10.0CISA KEVExploitedCisco ISE API authentication bypass, exploited on the network access control planeCisco Identity Services Engine (ISE) and ISE Passive Identity Connector · Cisco · 2026-09-16 · Actively exploited
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root. CVSS 10.0, exploited, CISA KEV on September 16, 2026.
- CVE-2024-3596critical 9.0Blast-RADIUS, MD5 collision forges Access-AcceptRADIUS (RFC 2865) · Protocol-wide · 2024-07-09 · Ongoing
A chosen-prefix MD5 collision on the RADIUS Response Authenticator lets a man-in-the-middle forge Access-Accept, bypass MFA, and escalate when CHAP/PAP run without Message-Authenticator. Protocol-wide. Vendors were still shipping patches into 2026.