Loading story…
Moxa issued advisory MPSA-263140 for multiple industrial and embedded computing product lines affected by three Linux kernel vulnerabilities: CVE-2026-31431 ("Copy Fail") and CVE-2026-43284 plus CVE-2026-43500 ("Dirty Frag"). The company said the flaws could allow unprivileged local users to gain administrative or root access on affected devices, with added risk of container escape and host compromise in environments running untrusted workloads. Canada’s Cyber Centre separately alerted operators to review Moxa’s guidance for impacted UC, V, VM, ioThinx, AIG, BXP, DRP, and RKP series products.
Because permanent fixes were not yet broadly available for all affected Moxa platforms, the vendor urged immediate mitigations such as blacklisting or unloading vulnerable kernel modules including rxrpc, esp4, and esp6, while warning that disabling esp4 and esp6 can break IPsec/VPN connectivity and some devices require bootloader changes because algif_aead is built into the kernel. For CTOS-based Debian systems, Moxa advised updating from Debian security repositories, reinstalling the x86 SDK, and rebooting. The advisory follows wider industry response to the same kernel bugs: CVE-2026-31431 was added to CISA’s Known Exploited Vulnerabilities catalog, Ubuntu released mitigations that disable the vulnerable module, and Red Hat published OpenShift guidance for Dirty Frag-related exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-26, Moxa published security advisory MPSA-263140 covering CVE-2026-31431, CVE-2026-43284, and CVE-2026-43500 across multiple industrial computing product lines. Moxa instructed customers to apply interim mitigations such as blacklisting or unloading vulnerable kernel modules and to monitor for permanent patch availability.
On 2026-05-18, Red Hat published remediation and mitigation guidance for OpenShift versions affected by CVE-2026-43284, including fixed z-stream releases and RHSA errata. Red Hat also stated CVE-2026-43500 does not affect OpenShift 4 or RHEL 9 and recommended blacklisting esp4, esp6, and rxrpc as an interim mitigation.
On 2026-05-13, AWS published security bulletin 2026-027 covering 'Dirty Frag' and related issues in Amazon Linux kernels. The reference indicates Amazon Linux issued vendor guidance for these kernel vulnerabilities.
On 2026-05-01, CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog, indicating active exploitation. The entry set a remediation due date of 2026-05-15.
On 2026-04-29, the NVD entry for CVE-2026-31431 documented the Linux kernel algif_aead vulnerability, noting public exploit references and available stable kernel patches through kernel.org. The record described the flaw as a local privilege escalation issue affecting multiple kernel version ranges.
On 2026-04-29, Ubuntu disclosed the high-severity Linux kernel local privilege escalation flaw CVE-2026-31431 ('Copy Fail'). Ubuntu released updated kmod packages to disable the vulnerable algif_aead module as an interim mitigation while kernel image fixes were still pending.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecyber.gc.ca
Open sourceaccess.redhat.com
Open sourceaws.amazon.com
Open sourceweb.nvd.nist.gov
Open sourceubuntu.com
Open sourcemoxa.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Moxa issued security advisories for multiple industrial and embedded product families, including the **UC Series**, **V Series**, **VM-1220 Series**, **ioThinx 4530 Series**, **AIG Series**, **BXP Series**, **DRP-A100/DRP-C100 Series**, and **RKP Series**. A Canadian Centre for Cyber Security notice highlighted the disclosures and directed operators to review Moxa’s published advisories and apply vendor-provided updates. The advisories include **`CVE-2026-46333`**, identified as the **"ssh-keysign-pwn"** vulnerability in the Linux kernel. The issue affects control-system environments using impacted Moxa platforms, raising patching and asset-review priorities for organizations that rely on these devices in operational technology and embedded deployments.
Jul 24, 2026
CERT-FR published two advisories covering vulnerabilities in **Moxa** products, warning that the flaws could let attackers **escalate privileges** and undermine core security controls. One notice said successful exploitation could also affect **data confidentiality** and **data integrity**, raising concern for industrial and networked environments where Moxa equipment is commonly deployed. A separate CERT-FR notice reported another Moxa vulnerability that could allow an attacker to **bypass the security policy**. The advisories did not provide further technical details in the referenced content, including affected models, `CVE` identifiers, or specific remediation steps, leaving organizations to monitor vendor and national CERT guidance closely for product impact and patch information.
Jun 29, 2026
**Moxa** published security advisories for its industrial computer **DA Series** indicating that multiple vulnerabilities in underlying **Intel firmware components** can impact affected devices, including conditions leading to **remote denial of service**, **privilege escalation**, and potential **confidentiality** impacts. Affected systems include **DA-682C** (BIOS versions prior to `v1.6`), **DA-820C** (prior to `v1.3`), and **DA-820E** (as listed by CERT-FR), with the Canadian Centre for Cyber Security also flagging DA Series BIOS exposure broadly and calling out DA-682C BIOS `v1.5` and earlier and DA-820C BIOS `v1.2` and earlier. The advisories map to Intel security issues including **Intel BIOS firmware DoS** (**INTEL-SA-00813**) and multiple vulnerabilities in **Intel CSME/AMT** (**INTEL-SA-00391**, **INTEL-SA-00709**). CERT-FR’s notice references related CVEs (including **CVE-2020-8747**, **CVE-2020-8749**, **CVE-2020-8752**, and **CVE-2022-28697**) and directs organizations to apply vendor-provided BIOS updates and mitigations from Moxa’s bulletins (`mpsa-256821`, `mpsa-256822`, `mpsa-256823`) to reduce exposure in operational technology environments.
Jun 29, 2026