# CWE-326: Inadequate Encryption Strength **KEV-linked** > As of 2026-10-22, CWE-326 (Inadequate Encryption Strength) underlies 4 CVEs tracked by Threadlinqs, 1 of them in the CISA Known Exploited Vulnerabilities catalog, and is cited by 11 tracked threats. **Last updated:** 2026-10-22 ## What is CWE-326? The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources. CWE-326 is a class-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Language: Not Language-Specific. _Source: [MITRE CWE](https://cwe.mitre.org/data/definitions/326.html) (CWE-326 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data._ ## Consequences - **Access Control, Confidentiality** — Bypass Protection Mechanism, Read Application Data. An attacker may be able to decrypt the data using brute force attacks. _Source: MITRE CWE, common consequences._ ## How CWE-326 is exploited in the wild Threadlinqs maps 4 CVEs to CWE-326, published between 2017-08-23 and 2026-10-18. 1 is listed in CISA’s Known Exploited Vulnerabilities catalog, the authoritative record of exploitation in the wild. By CVSS v3 severity the set splits into 1 critical, 1 medium, 2 low. The highest EPSS score in the set is 84.1% (CVE-2017-11317), the modelled probability of exploitation in the next 30 days. 11 tracked threats reference CWE-326 directly or through a CVE it covers; the most recent is “Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)” (2026-10-16). Affected products concentrate in Pronetiqs (1), diem-project (1), light0011 (1). ## Vulnerabilities (CVEs) All 4 CVEs mapped to CWE-326, CISA KEV first, then by CVSS score. - [CVE-2017-11317](https://intel.threadlinqs.com/cve/CVE-2017-11317) — CISA KEV · CVSS 9.8 critical · EPSS 84.1% · published 2017-08-23 - [CVE-2026-50044](https://intel.threadlinqs.com/cve/CVE-2026-50044) — CVSS 6.8 medium · EPSS 0.0% · published 2026-07-23 - [CVE-2026-112026](https://intel.threadlinqs.com/cve/CVE-2026-112026) — CVSS 3.7 low · EPSS 0.2% · published 2026-10-18 - [CVE-2026-112029](https://intel.threadlinqs.com/cve/CVE-2026-112029) — CVSS 2.5 low · EPSS 0.0% · published 2026-10-18 ## Affected vendors - [Pronetiqs](https://intel.threadlinqs.com/vendors/pronetiqs) — 1 CVE - **diem-project** — 1 CVE - **light0011** — 1 CVE ## Threat activity 11 tracked threats cite CWE-326: - [Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)](https://intel.threadlinqs.com/threat/TL-2026-3700) — HIGH · 2026-10-16 - [LiteLLM gateway vulnerabilities: missing authorization, SSRF, file read and RCE (CVE-2026-35029, CVE-2026-59823)](https://intel.threadlinqs.com/threat/TL-2026-3417) — HIGH · 2026-10-13 - [CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS Servers](https://intel.threadlinqs.com/threat/TL-2026-2726) — CRITICAL · 2026-09-28 - [Telerik UI for ASP.NET AJAX — Padding Oracle Chained to Unauthenticated Deserialization RCE (CVE-2026-13181–13184)](https://intel.threadlinqs.com/threat/TL-2026-2369) — HIGH · 2026-09-07 - [Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin Wallet Theft ($70.2M Drained)](https://intel.threadlinqs.com/threat/TL-2026-1840) — CRITICAL · 2026-08-03 - [EndPoint (Midnight) Ransomware — Babuk-derived double-extortion targeting Windows, ESXi, and NAS](https://intel.threadlinqs.com/threat/TL-2026-0742) — CRITICAL · 2026-06-09 - [Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi](https://intel.threadlinqs.com/threat/TL-2026-0412) — CRITICAL · 2026-04-22 - [APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting](https://intel.threadlinqs.com/threat/TL-2026-0339) — CRITICAL · 2026-04-09 - [FortiGate SSO Authentication Bypass Campaign (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858)](https://intel.threadlinqs.com/threat/TL-2026-0205) — CRITICAL · 2026-03-10 - [25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password Managers (Bitwarden/LastPass/Dashlane) — ETH Zurich Research, Key Escrow, AES-CBC Malleability, KDF Downgrade (300Kx Brute-Force), Unauthenticated Public Keys, 60M+ Users](https://intel.threadlinqs.com/threat/TL-2026-0122) — HIGH · 2026-02-17 - [LockBit 5.0 Cross-Platform Ransomware Analysis](https://intel.threadlinqs.com/threat/TL-2026-0062) — CRITICAL · 2026-02-12 ## Mitigations - **Architecture and Design**: Use an encryption scheme that is currently considered to be strong by experts in the field. _Source: MITRE CWE, potential mitigations._ ## Detection methods (MITRE CWE) - **Automated Static Analysis** (effectiveness: High): Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) _Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher._ ## Related weaknesses - [CWE-693 Protection Mechanism Failure](https://intel.threadlinqs.com/cwe/CWE-693) Canonical: https://intel.threadlinqs.com/cwe/CWE-326 Source definition: https://cwe.mitre.org/data/definitions/326.html Detection rules and IOCs for threats exploiting CWE-326 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp