CVE-2026-74649: staging: rtl8723bs: fix missing shared-key auth challenge length check

highCVSS 8.3CVE-2026-74649

CSIRTS triage

vendor: Linux product: Linux kernel Authentication bypass

What: Missing shared-key authentication challenge length check in rtl8723bs staging driver allows bypass of authentication validation.
Who is affected: Systems running Linux kernel with rtl8723bs WiFi driver enabled.
Urgency: High severity (CVSS 8.3) authentication bypass affecting WiFi security; not yet exploited but requires prompt patching.
Action: Update to patched Linux kernel version containing the rtl8723bs fix.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Linux kernel

Get an email when a new Linux kernel advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: high — CVSS 8.3
Published: 2026-08-11
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-74649

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-746490.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-74649	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for staging

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-82182: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a …nvd · 2026-09-02
unknownCVE-2026-19722: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate th…nvd · 2026-08-30
highCVE-2026-76586: The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 do…nvd · 2026-08-29
mediumCVE-2026-82018: IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot byp…nvd · 2026-08-28
unknownCVE-2026-19485: A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI…nvd · 2026-08-26
highCVE-2026-19718: The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin…nvd · 2026-08-26