CVE-2026-7422

MEDIUMNVD 6.56.5—
EchelonGraph scoreMEDIUM confidence

This medium-severity CVE scores 6.5 under NVD CVSS v3. EPSS exploit probability: 0.0%, top 91% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, nvd
6.5

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint.

To mitigate this issue, users should upgrade to the fixed version when available.

CVSS v3
6.5
EG Score
6.5(medium)
EPSS
9.1%
KEV
Not listed

Published

April 29, 2026

Last Modified

May 4, 2026

References (4)

Frequently asked(5)

What is CVE-2026-7422?
CVE-2026-7422 is a medium vulnerability published on April 29, 2026. Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection…
When was CVE-2026-7422 disclosed?
CVE-2026-7422 was first published in the National Vulnerability Database on April 29, 2026, with the most recent update on May 4, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-7422 actively exploited?
CVE-2026-7422 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 9.1% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2026-7422?
CVE-2026-7422 has a CVSS v3 base score of 6.5 (NVD).
How do I remediate CVE-2026-7422?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-7422, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-7422

Explore →

Is Your Infrastructure Affected by CVE-2026-7422?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs