CVE-2026-47895 affects strongSwan, a widely used open-source VPN platform that helps remote employees, branch offices, and cloud systems connect securely. If your organization operates an Internet-facing VPN gateway, this vulnerability deserves prompt attention because a remote attacker may be able to disrupt the service or, in the worst case, execute code on the gateway.
This post explains the vulnerability in business terms, identifies who is exposed, and provides practical response steps. A technical appendix gives security engineers and penetration testers the detail needed to verify exposure and remediate it safely.
strongSwan disclosed CVE-2026-47895 on June 8, 2026, and released strongSwan 6.0.7 with the fix on the same day. The vulnerability was reported by R. Elliott Childre and affects strongSwan versions from 4.3.3 through all releases before 6.0.7.
The issue is a double-free memory error in the identity-handling code of libstrongswan. In practical terms, the software can accidentally release the same block of memory twice, which can crash the VPN service and may potentially allow remote code execution.
The CVE was published to NVD on August 22, 2026. It is rated High with a CVSS 3.1 base score of 7.5, using the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Your VPN gateway is often the front door to internal applications, file shares, administrative systems, and cloud environments. If an attacker can crash it, employees and partners may lose remote access, branch connectivity may fail, and incident response teams may be pulled away from other priorities.
The more serious concern is potential remote code execution. If exploited for code execution, an attacker could gain a foothold on the VPN server, potentially access credentials or session information, pivot into internal networks, or alter VPN routing and access rules.
A VPN outage can also create compliance and contractual problems. Organizations subject to security obligations in the United States and Canada may need to document the vulnerability, patch timeline, affected systems, and any evidence of exploitation. Customers and partners may reasonably ask whether remote access was protected during the exposure window.
Reputation risk follows operational risk. A preventable VPN compromise can undermine confidence in your security program, particularly if the gateway protects privileged access or sensitive customer data. The good news is that a vendor fix is available, and organizations that do not use the relevant authentication methods have a materially lower remote risk.
Regional financial services firm: A regional bank uses strongSwan to connect branch offices and allow employees to reach core applications. A successful attack could interrupt teller and back-office workflows, delay customer service, and trigger regulatory incident documentation even if no customer data is ultimately accessed.
Mid-market healthcare organization: A healthcare provider relies on VPN access for clinicians, billing vendors, and remote IT administrators. If the gateway crashes repeatedly, staff may be unable to reach scheduling and records systems, while security teams must determine whether the incident affects protected health information safeguards.
SaaS company with distributed engineering teams: A software company uses VPN access for developer environments and cloud administration. An attacker who gains code execution on the gateway could attempt to reach internal build systems or cloud management interfaces, turning a VPN issue into a broader supply-chain and intellectual-property risk.
Public-sector municipality: A municipality provides remote access to contractors and departmental staff. A VPN outage could disrupt permitting, emergency coordination tools, and vendor payments, while a compromise could expose internal network paths and citizen-service systems to further attacks.
xauth-eap plugin.Class or Filter-Id attributes.If strongSwan supports remote access in your environment, do not wait for an outage or suspicious activity to confirm your exposure. IntegSec can assess your VPN architecture, validate patch status, test authentication paths, and identify the broader weaknesses that attackers often use after an initial foothold. Visit https://integsec.com to schedule a penetration test and strengthen your organization's cybersecurity risk reduction program.
CVE-2026-47895 is a double-free condition in the identification_t::clone() method within libstrongswan. The clone operation copies the full object structure, including the encoded chunk, but only replaces the cloned encoding when its length is nonzero. For an identity with an empty but non-NULL encoding, both objects retain the same pointer, causing a double free when both are destroyed.
The condition is reachable through identities parsed with the @# or <type>:# hexadecimal-identity syntax, where chunk_from_hex() allocates a zero-length buffer. EAP identity handling makes the issue remotely reachable: after an EAP-Identity exchange, the identity is cloned into an auth_cfg_t object, and authentication failure commonly leads to IKE SA destruction and the double free.
The attack vector is network-based, with high attack complexity, low privileges required, no user interaction, and unchanged scope. NVD lists the weakness as CWE-415, Double Free; the CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
The official NVD reference is https://nvd.nist.gov/vuln/detail/cve-2026-47895. strongSwan notes that remote code execution may be possible, although a crash is the more certain outcome.
Version enumeration commands:
Scanner signatures: Scan for strongSwan package versions below 6.0.7, vendor-specific fixed package versions, and exposed IKE services. Validate scanner findings against installed package records rather than relying only on service banners.
Log indicators and behavioral anomalies:
charon daemon restarts, segmentation faults, or core dumps.xauth-eap.Network exploitation indicators:
eap-radius parses Class or Filter-Id group identities.xauth-eap where IKEv1 XAuth is still used, and replace legacy IKEv1 remote access with a supported, patched IKEv2 configuration. Confirm patch deployment across all gateway replicas, containers, appliances, and golden images. Test VPN authentication, routing, DNS, and split-tunnel behavior before declaring remediation complete.charon stability, authentication failures, and identity-parsing anomalies, and maintain a tested incident-response playbook for VPN compromise or denial of service.