CVE Intelligence
Analysis AI-assisted

CVE-2026-50086: Aqara IAM/SSO gateway unauthenticated AES oracle

The Aqara IAM/SSO gateway at gw-builder.aqara.com reportedly exposes AES round-trip operations tied to the platform signing key without authentication, as described by runZero. NVD lists a CVSS score of 9.8 while the description text states an estimated 7.5, so this discrepancy should be checked against the sources. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-50086 describes an unauthenticated AES oracle in the Aqara IAM/SSO gateway at gw-builder.aqara.com. According to the description, the gateway performs bidirectional AES operations against the platform signing key without requiring authentication. The description maps the issue to CWE-306 and CWE-327, while the structured CWE field lists CWE-327.

Impact

  • Confirmed: the description states that unauthenticated callers can reach AES round-trip operations tied to the signing key.
  • Inference: exposure of such an operation could affect the confidentiality or integrity of data and trust decisions handled by the gateway, but the sources do not detail the actual consequences.
  • The NVD entry in the record lists high confidentiality, integrity and availability impact with a score of 9.8, while the description text gives an estimated 7.5 with no integrity or availability impact. The sources do not reconcile these figures.

Affected products and versions

  • Product: Aqara IAM/SSO Gateway.
  • Versions listed in the record: 2026-04-20 and the range 2026-04-20 and later.
  • Fixed versions: none listed in the record. This does not establish that no fix exists; the status is unknown.

Exploitation status

  • The record shows the entry is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
  • The SSVC exploitation value is poc, and automatable is yes, as recorded by the data source.
  • The references include a public third-party repository tagged as exploit-related. Its content was not analyzed for this summary.
  • EPSS probability is 0.00441 with percentile 0.37301, dated 2026-10-23.

Remediation and mitigation

  • Identify whether the Aqara IAM/SSO gateway is deployed in your environment and whether it runs the listed version range.
  • Restrict network access to the gateway to trusted segments until the vendor publishes guidance.
  • Follow the runZero advisory and vendor communications for remediation details.
  • Review whether signing-key rotation is warranted based on vendor guidance and your exposure assessment.

Detection guidance

  • Review access logs for the gateway for requests from unexpected or external sources that do not carry authentication.
  • Watch for unusual volumes of requests to cryptographic endpoints of the gateway, at a general level, and correlate with asset inventory.

Limitations of the available information

  • No fixed version is present in the record.
  • The CVSS figures differ between the NVD entry (9.8), the CNA-provided scores (10) and the estimate in the description text (7.5).
  • The record does not identify the exact endpoints or the precise conditions under which the behaviour occurs.
  • The linked repository was not reviewed in detail, and no vendor advisory was available in the record.

Frequently asked questions

Is CVE-2026-50086 known to be actively exploited?

The record shows the entry is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The record does reference a third-party repository tagged as exploit-related, which was not analyzed here.

Which Aqara versions are affected?

The record lists the Aqara IAM/SSO Gateway at version 2026-04-20 and at 2026-04-20 and later. No fixed version is listed in the record, so the availability of a fix is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.