Multiple Vulnerabilities in strongSwan

The French National Cybersecurity Agency (ANSSI) has released an advisory regarding multiple critical vulnerabilities affecting the strongSwan IPsec VPN suite. These vulnerabilities, identified as CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134, and CVE-2026-78135, impact all versions of strongSwan prior to 6.1.0. Depending on the specific flaw, an unauthenticated remote attacker could potentially trigger arbitrary remote code execution, perform denial-of-service attacks, or bypass existing security policy configurations. Organizations utilizing strongSwan for secure network connectivity are advised to review the vendor-provided security bulletins and apply updates immediately. Given the nature of these vulnerabilities, the potential for service disruption or compromise of network security boundaries is high for internet-facing VPN gateways.

Impact

Successful exploitation of these vulnerabilities can lead to full system compromise via remote code execution, persistent denial-of-service, or the subversion of network security policies. This poses a significant risk to organizations relying on strongSwan to secure sensitive data in transit, potentially allowing unauthorized access to internal network resources or the total loss of VPN gateway availability.

Recommendation

Prioritize patching all strongSwan instances to version 6.1.0 or later immediately. Refer to the official strongSwan security blog for specific remediation instructions for each CVE ID: CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134, and CVE-2026-78135.