The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freeradius-ldapUpgrade krb5-serverUpgrade freeradius-sqliteUpgrade krb5-pkinitUpgrade freeradius-utilsUpgrade krb5-workstationUpgrade freeradius-restUpgrade python3-freeradiusUpgrade freeradius-unixODBCUpgrade freeradius-develUpgrade freeradius-docUpgrade krb5-develUpgrade freeradiusUpgrade krb5-libsUpgrade freeradius-postgresqlUpgrade freeradius-mysqlUpgrade krb5-server-ldapUpgrade freeradius-krb5Upgrade freeradius-perlUpgrade libkadm5 | Aug 8, 2024 | Jul 9, 2024 |
| Alpine Linux | — | Upgrade freeradius | Aug 8, 2025 | Jul 9, 2024 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-ldapUpgrade freeradius-develUpgrade freeradius-unixODBCUpgrade freeradius-debuginfoUpgrade freeradius-krb5Upgrade freeradius-mysqlUpgrade freeradius-sqliteUpgrade freeradius-docUpgrade freeradiusUpgrade freeradius-utilsUpgrade freeradius-perlUpgrade freeradius-pythonUpgrade freeradius-postgresql | Aug 14, 2024 | Jul 9, 2024 |
| Arista Eos | — | Use RADIUS over TLS (RadSec) if available, or alternative authentication methods. | Sep 4, 2024 | Jul 9, 2024 |
| Aruba Aos 10 | — | This vulnerability is fixed in the following HPE Aruba Networking products' software releases
- - AirWave Management Platform
- 8.3.0.3 and above
- - ClearPass Policy Manager
- 6.12.2 and above
- 6.11.9 and above
- In addition, the following steps need to be taken to enable
the RADIUS Message-Authenticator on ClearPass Navigate to
Administration > Server Manager > Server Configuration screen,
select each server individually to enable Message-Authenticator
support.
On the server screen, navigate to "Service Parameters" tab,
select the 'Radius server' service.
Under the Security header, modify the parameters
Require Message-Authenticator from NAD = yes
Require Message-Authenticator from Proxy Server = yes
Save the changes. This will then restart the service with the
requirement that the Message-Authenticator be transmitted, or the
request will not be processed.
- - Switches running AOS-CX
- 10.14.1010 and above
- 10.13.1040 and above
- 10.10.1140 and above
- - WLAN Gateways and SD-WAN Gateways running AOS-10
- AOS-10.6.0.3 and above
- AOS-10.4.1.4 and above
- - Mobility Controllers running AOS-8
- AOS-8.12.0.2 and above
- AOS-8.10.0.14 and above
- - Aruba Fabric Composer
- 7.1.1 and above
- - EdgeConnect SD-WAN Orchestrator
- Use the following link to find instructions for addressing CVE-2024-3596:
https://www.arubanetworks.com/techdocs/sdwan-PDFs/docs/advisories/or
ch_resolution_to_cve-2024-3596_latest.pdf
- - HPE Networking Instant On
- Switch series 1930 and 1960 firmware version 3.1.0 for local mode
- Upgrade Access Points firmware to version 3.1.0 and use option
"Require RADIUS Message-Authenticator" if using an external guest
portal.
Software updates for this vulnerability fix in the other affected products are forthcoming. This advisory will be updated as details on the respective product's software versions with this vulnerability fix become available.
For more information about HPE Aruba Networking products End of Support policy visit:
https://networkingsupport.hpe.com/end-of-life | Jan 14, 2025 | Jul 12, 2024 |
| Aruba Aos 8 | — | This vulnerability is fixed in the following HPE Aruba Networking products' software releases
- - AirWave Management Platform
- 8.3.0.3 and above
- - ClearPass Policy Manager
- 6.12.2 and above
- 6.11.9 and above
- In addition, the following steps need to be taken to enable
the RADIUS Message-Authenticator on ClearPass Navigate to
Administration > Server Manager > Server Configuration screen,
select each server individually to enable Message-Authenticator
support.
On the server screen, navigate to "Service Parameters" tab,
select the 'Radius server' service.
Under the Security header, modify the parameters
Require Message-Authenticator from NAD = yes
Require Message-Authenticator from Proxy Server = yes
Save the changes. This will then restart the service with the
requirement that the Message-Authenticator be transmitted, or the
request will not be processed.
- - Switches running AOS-CX
- 10.14.1010 and above
- 10.13.1040 and above
- 10.10.1140 and above
- - WLAN Gateways and SD-WAN Gateways running AOS-10
- AOS-10.6.0.3 and above
- AOS-10.4.1.4 and above
- - Mobility Controllers running AOS-8
- AOS-8.12.0.2 and above
- AOS-8.10.0.14 and above
- - Aruba Fabric Composer
- 7.1.1 and above
- - EdgeConnect SD-WAN Orchestrator
- Use the following link to find instructions for addressing CVE-2024-3596:
https://www.arubanetworks.com/techdocs/sdwan-PDFs/docs/advisories/or
ch_resolution_to_cve-2024-3596_latest.pdf
- - HPE Networking Instant On
- Switch series 1930 and 1960 firmware version 3.1.0 for local mode
- Upgrade Access Points firmware to version 3.1.0 and use option
"Require RADIUS Message-Authenticator" if using an external guest
portal.
Software updates for this vulnerability fix in the other affected products are forthcoming. This advisory will be updated as details on the respective product's software versions with this vulnerability fix become available.
For more information about HPE Aruba Networking products End of Support policy visit:
https://networkingsupport.hpe.com/end-of-life | Jan 14, 2025 | Jul 12, 2024 |
| Aruba Aos Cx | — | This vulnerability is fixed in the following HPE Aruba Networking products' software releases
- - AirWave Management Platform
- 8.3.0.3 and above
- - ClearPass Policy Manager
- 6.12.2 and above
- 6.11.9 and above
- In addition, the following steps need to be taken to enable
the RADIUS Message-Authenticator on ClearPass Navigate to
Administration > Server Manager > Server Configuration screen,
select each server individually to enable Message-Authenticator
support.
On the server screen, navigate to "Service Parameters" tab,
select the 'Radius server' service.
Under the Security header, modify the parameters
Require Message-Authenticator from NAD = yes
Require Message-Authenticator from Proxy Server = yes
Save the changes. This will then restart the service with the
requirement that the Message-Authenticator be transmitted, or the
request will not be processed.
- - Switches running AOS-CX
- 10.14.1010 and above
- 10.13.1040 and above
- 10.10.1140 and above
- - WLAN Gateways and SD-WAN Gateways running AOS-10
- AOS-10.6.0.3 and above
- AOS-10.4.1.4 and above
- - Mobility Controllers running AOS-8
- AOS-8.12.0.2 and above
- AOS-8.10.0.14 and above
- - Aruba Fabric Composer
- 7.1.1 and above
- - EdgeConnect SD-WAN Orchestrator
- Use the following link to find instructions for addressing CVE-2024-3596:
https://www.arubanetworks.com/techdocs/sdwan-PDFs/docs/advisories/or
ch_resolution_to_cve-2024-3596_latest.pdf
- - HPE Networking Instant On
- Switch series 1930 and 1960 firmware version 3.1.0 for local mode
- Upgrade Access Points firmware to version 3.1.0 and use option
"Require RADIUS Message-Authenticator" if using an external guest
portal.
Software updates for this vulnerability fix in the other affected products are forthcoming. This advisory will be updated as details on the respective product's software versions with this vulnerability fix become available.
For more information about HPE Aruba Networking products End of Support policy visit:
https://networkingsupport.hpe.com/end-of-life | Feb 5, 2025 | Jul 12, 2024 |
| Aruba Ecos | — | This vulnerability is fixed in the following HPE Aruba Networking products' software releases
- - AirWave Management Platform
- 8.3.0.3 and above
- - ClearPass Policy Manager
- 6.12.2 and above
- 6.11.9 and above
- In addition, the following steps need to be taken to enable
the RADIUS Message-Authenticator on ClearPass Navigate to
Administration > Server Manager > Server Configuration screen,
select each server individually to enable Message-Authenticator
support.
On the server screen, navigate to "Service Parameters" tab,
select the 'Radius server' service.
Under the Security header, modify the parameters
Require Message-Authenticator from NAD = yes
Require Message-Authenticator from Proxy Server = yes
Save the changes. This will then restart the service with the
requirement that the Message-Authenticator be transmitted, or the
request will not be processed.
- - Switches running AOS-CX
- 10.14.1010 and above
- 10.13.1040 and above
- 10.10.1140 and above
- - WLAN Gateways and SD-WAN Gateways running AOS-10
- AOS-10.6.0.3 and above
- AOS-10.4.1.4 and above
- - Mobility Controllers running AOS-8
- AOS-8.12.0.2 and above
- AOS-8.10.0.14 and above
- - Aruba Fabric Composer
- 7.1.1 and above
- - EdgeConnect SD-WAN Orchestrator
- Use the following link to find instructions for addressing CVE-2024-3596:
https://www.arubanetworks.com/techdocs/sdwan-PDFs/docs/advisories/or
ch_resolution_to_cve-2024-3596_latest.pdf
- - HPE Networking Instant On
- Switch series 1930 and 1960 firmware version 3.1.0 for local mode
- Upgrade Access Points firmware to version 3.1.0 and use option
"Require RADIUS Message-Authenticator" if using an external guest
portal.
Software updates for this vulnerability fix in the other affected products are forthcoming. This advisory will be updated as details on the respective product's software versions with this vulnerability fix become available.
For more information about HPE Aruba Networking products End of Support policy visit:
https://networkingsupport.hpe.com/end-of-life | Sep 25, 2025 | Jul 12, 2024 |
| Cisco Asa | — | Upgrade to the latest version of Cisco ASA to resolve this vulnerability. | Jan 19, 2026 | Jul 10, 2024 |
| Debian | — | Upgrade freeradius | May 15, 2025 | Jul 9, 2024 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 9, 2024 |
| Fortinet Fortianalyzer | — | Upgrade to the latest version of FortiAnalyzerUpgrade FortiAnalyzer to 7.2.10Upgrade FortiAnalyzer to 7.6.2Upgrade FortiAnalyzer to 7.4.6 | May 26, 2026 | Aug 13, 2024 |
| Fortinet Fortiauthenticator | — | Upgrade FortiAuthenticator to 6.4.10Upgrade FortiAuthenticator to 6.5.6Upgrade FortiAuthenticator to 6.6.3 | Aug 5, 2026 | Aug 13, 2024 |
| Fortinet Fortimanager | — | Upgrade to the latest version of FortiManagerUpgrade FortiManager to 7.6.2Upgrade FortiManager to 7.2.10Upgrade FortiManager to 7.4.6 | May 25, 2026 | Aug 13, 2024 |
| Fortinet Fortiproxy | — | Upgrade FortiProxy to 7.4.6Upgrade to the latest version of FortiProxy | Sep 30, 2026 | Aug 13, 2024 |
| Fortinet Fortisandbox | — | Upgrade FortiSandbox to 4.4.7Upgrade to the latest version of FortiSandboxUpgrade FortiSandbox to 5.0.1 | Oct 1, 2026 | Aug 13, 2024 |
| Fortinet Fortiweb | — | Upgrade FortiWeb to 7.6.1Upgrade to the latest version of FortiWebUpgrade FortiWeb to 7.4.5 | Jun 30, 2026 | Aug 13, 2024 |
| Fortios | — | Upgrade FortiOS to 7.2.11Upgrade FortiOS to 7.6.1Upgrade to the latest version of FortiOSUpgrade FortiOS to 7.4.6 | Mar 12, 2025 | Aug 13, 2024 |
| Msft | — | 2024-07 Cumulative Update for Microsoft Windows 11, version 23H2 (KB5040442)2024-07 Cumulative Update for Microsoft Windows Server 2012 (KB5040485)2024-07 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5040430)2024-07 Cumulative Update for Microsoft Windows 10, version 1507 (KB5040448)2024-07 Cumulative Update for Microsoft Windows 10, version 22H2 (KB5040427)2024-07 Cumulative Update for Microsoft Windows Server 2022, version 23H2 (KB5040438)2024-07 Cumulative Update for Microsoft Windows Server 2022, version 21H2 (KB5040437)2024-07 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5040498)2024-07 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5040434)2024-07 Cumulative Update for Microsoft Windows 10, version 21H2 (KB5040427)2024-07 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5040490)2024-07 Cumulative Update for Microsoft Windows Server 2022, version 22H2 (KB5040437)2024-07 Cumulative Update for Microsoft Windows 10, version 1809 (KB5040430)2024-07 Cumulative Update for Microsoft Windows 10, version 1607 (KB5040434)2024-07 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5040490)2024-07 Cumulative Update for Microsoft Windows 11, version 21H2 (KB5040431)2024-07 Cumulative Update for Microsoft Windows 11, version 22H2 (KB5040442)2024-07 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5040456) | Jul 9, 2024 | Jul 9, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 3, 2025 |
| Oracle_linux | — | Upgrade freeradius-mysqlUpgrade freeradius-krb5Upgrade krb5-libsUpgrade freeradiusUpgrade freeradius-docUpgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-server-ldapUpgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade python3-freeradiusUpgrade freeradius-ldapUpgrade krb5-develUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-unixODBCUpgrade freeradius-restUpgrade krb5-workstationUpgrade freeradius-pythonUpgrade krb5-serverUpgrade freeradius-sqlite | Aug 16, 2024 | Jul 9, 2024 |
| Palo Alto Networks Pan Os | — | Upgrade Palo Alto Networks PAN-OS to the latest version | Jan 7, 2025 | Jul 10, 2024 |
| Panos | — | — | Jul 11, 2024 | Jul 9, 2024 |
| Redhat_linux | — | Upgrade krb5-serverUpgrade krb5-debugsourceUpgrade libkadm5-debuginfoUpgrade krb5-libsUpgrade freeradius-rest-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-postgresql-debuginfoUpgrade libkadm5Upgrade freeradius-perl-debuginfoUpgrade krb5-server-ldapUpgrade freeradius-pythonUpgrade krb5-libs-debuginfoUpgrade freeradius-ldapUpgrade krb5-server-debuginfoUpgrade freeradius-sqliteUpgrade krb5-workstationUpgrade freeradius-postgresqlUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-krb5-debuginfoUpgrade freeradius-mysqlUpgrade krb5-devel-debuginfoUpgrade freeradius-restUpgrade freeradius-mysql-debuginfoUpgrade freeradius-docUpgrade freeradius-krb5Upgrade python3-freeradiusUpgrade freeradius-unixODBCUpgrade freeradius-perlUpgrade freeradius-sqlite-debuginfoUpgrade krb5-develUpgrade python3-freeradius-debuginfoUpgrade krb5-pkinitUpgrade krb5-workstation-debuginfoUpgrade freeradius-debugsourceUpgrade krb5-pkinit-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade krb5-server-ldap-debuginfoNo solution existsUpgrade krb5-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradiusUpgrade freeradius-ldap-debuginfo | Jul 25, 2024 | Jul 9, 2024 |
| Rocky_linux | — | Upgrade freeradius-krb5Upgrade freeradius-debugsourceUpgrade freeradius-docUpgrade freeradius-mysqlUpgrade freeradius-krb5-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-workstationUpgrade krb5-debuginfoUpgrade python3-freeradiusUpgrade freeradius-perlUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-rest-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-devel-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade python3-freeradius-debuginfoUpgrade krb5-debugsourceUpgrade krb5-server-ldap-debuginfoUpgrade freeradiusUpgrade freeradius-postgresqlUpgrade krb5-server-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-develUpgrade libkadm5Upgrade krb5-pkinitUpgrade krb5-libs-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-utils-debuginfoUpgrade freeradius-ldapUpgrade krb5-serverUpgrade freeradius-restUpgrade freeradius-perl-debuginfoUpgrade freeradius-utilsUpgrade freeradius-debuginfoUpgrade krb5-libsUpgrade freeradius-postgresql-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-develUpgrade freeradius-ldap-debuginfoUpgrade freeradius-unixODBC-debuginfo | Aug 1, 2024 | Jul 9, 2024 |
| Suse | — | Upgrade freeradius-server-develUpgrade freeradius-server-python3Upgrade freeradius-server-utilsUpgrade freeradius-server-libsUpgrade freeradius-server-postgresqlUpgrade freeradius-serverUpgrade freeradius-server-sqliteUpgrade freeradius-server-mysqlUpgrade freeradius-server-docUpgrade freeradius-server-krb5Upgrade freeradius-server-perlUpgrade freeradius-server-ldap-schemasUpgrade freeradius-server-ldapUpgrade freeradius-server-python | Jul 10, 2024 | Jul 9, 2024 |
| Ubuntu | — | Upgrade libk5crypto3 (Ubuntu Pro)Upgrade libk5crypto3Upgrade libkrad0 (Ubuntu Pro)Upgrade freeradiusUpgrade libkrad0 | Oct 4, 2024 | Jul 9, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jul 9, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub