What is the official website of CIT Bank ?

The official website of CIT Bank is https://www.cit.com/cit-bank/.

What is CIT Bank's cybersecurity risk score?

CIT Bank has an AI-generated cybersecurity risk score of 755 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has CIT Bank experienced?

According to Rankiteo, CIT Bank currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has CIT Bank been affected by any supply chain cyber incidents ?

According to Rankiteo, CIT Bank has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does CIT Bank have SOC 2 Type 1 certification ?

According to Rankiteo, CIT Bank is not certified under SOC 2 Type 1.

Does CIT Bank have SOC 2 Type 2 certification ?

According to Rankiteo, CIT Bank does not hold a SOC 2 Type 2 certification.

Does CIT Bank comply with GDPR ?

According to Rankiteo, CIT Bank is not listed as GDPR compliant.

Does CIT Bank have PCI DSS certification ?

According to Rankiteo, CIT Bank does not currently maintain PCI DSS compliance.

Does CIT Bank comply with HIPAA ?

According to Rankiteo, CIT Bank is not compliant with HIPAA regulations.

Does CIT Bank have ISO 27001 certification ?

According to Rankiteo,CIT Bank is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does CIT Bank operate in ?

CIT Bank operates primarily in the Banking industry.

How many employees does CIT Bank have ?

CIT Bank employs approximately 339 people worldwide.

Does CIT Bank own any subsidiaries ?

CIT Bank presently has no subsidiaries across any sectors.

How many LinkedIn followers does CIT Bank have ?

CIT Bank's official LinkedIn profile has approximately 5,243 followers.

What is the NAICS classification code for CIT Bank ?

CIT Bank is classified under the NAICS code 52211, which corresponds to Commercial Banking.

Does CIT Bank have a Crunchbase profile ?

No, CIT Bank does not have a profile on Crunchbase.

Does CIT Bank have a LinkedIn profile ?

Yes, CIT Bank maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cit-bank.

How many cybersecurity incidents has CIT Bank experienced ?

As of August 3, 2026, Rankiteo reports that CIT Bank has experienced 1 cybersecurity incidents.

How many peer or competitor companies does CIT Bank have ?

CIT Bank has an estimated 7,449 peer or competitor companies worldwide.

What types of cybersecurity incidents has CIT Bank faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

CIT Bank

Boost Score +25 with badge (5 left)

755

/1000

Fair

780

/1000

Fair

CIT Bank Vendor Cyber Rating & Cyber Score

cit.com

Add Your Compliance Badge

An innovative digital bank with one goal: to help you earn more and grow your savings. A division of First Citizens Bank, Member FDIC. As America’s largest family-controlled bank, First Citizens is continuing a unique legacy of strength, stability and long-term thinking that has spanned generations. Learn more at cit.com/firstcitizens.

CIT Bank A.I CyberSecurity Scoring

Scoring History

CIT Bank

CIT Bank CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

First Citizens Bank

Breach

100

1/2025

FROCOICHACARCHA...

Loading…

A.I.

CIT Bank Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for CIT Bank

Incidents vs Banking Industry Avg (This Year)

No incidents recorded for CIT Bank in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for CIT Bank in 2026.

Incident Types CIT Bank vs Banking Industry Avg (This Year)

No incidents recorded for CIT Bank in 2026.

Incident History - CIT Bank (X = Date, Y = Severity)

Loading…

SUBSIDIARY

CIT Bank Subsidiaries

CIT Bank

Banking

Website: https://www.cit.com/cit-bank/

Company Size: 1,001-5,000 employees

First Citizens BankBanking

Silicon Valley BankBanking

SVB PrivateBanking

CIT RailRail Transportation

First Citizens Investor ServicesInvestment Management

Loading…

CIT Bank Similar Companies

Bank Mega

bankmega.com

Sebagai bagian dari CT Corp, Bank Mega terus menghadirkan layanan perbankan yang modern, inklusif, dan berorientasi pada kebutuhan masyarakat Indonesia. Mengusung visi “Menjadi Kebanggaan Bangsa”, kami berkomitmen menciptakan nilai tambah bagi nasabah dan karyawan melalui sinergi ekosistem terintegrasi, sekaligus menjadi tempat terbaik bagi talenta untuk tumbuh dan berkontribusi bagi kemajuan bangsa. Bank Mega juga konsisten mengembangkan layanan perbankan digital dengan menyediakan solusi yang mudah, aman, dan efisien bagi nasabah. Sebagai salah satu pelopor implementasi QRIS Cross Border untuk transaksi lintas negara dan QRIS TAP untuk layanan transportasi, Bank Mega memperkuat komitmennya melalui aplikasi M-Smile untuk menciptakan pengalaman transaksi yang nyaman. Langkah ini menegaskan tekad Bank Mega untuk memberikan pengalaman perbankan yang modern, relevan, dan turut mendukung pertumbuhan ekonomi digital Indonesia. Didukung oleh sumber daya manusia yang profesional, budaya kerja Dynamics, Entrepreneurship, Trust, Ethics, Commitment, dan Synergy (DETECS) menjadi fondasi kami dalam menciptakan lingkungan kerja yang kolaboratif dan berdaya saing tinggi. Melalui berbagai inisiatif, penghargaan, dan program berkelanjutan, Bank Mega terus memperkuat perannya sebagai lembaga keuangan yang mendorong pertumbuhan ekonomi nasional sekaligus memberikan dampak positif bagi masyarakat. Pencapaian terbaru Bank Mega di tahun 2025: * Investortrust – The Best Bank 2025 untuk kategori KBMI 3 * Stellar Workplace Recognition in Employee Commitment 2025 * Stellar Workplace Recognition in Employee Satisfaction 2025 * 100 Indonesia's Biggest Companies 2025 versi Fortune Indonesia * Katadata ESG Index Awards sebagai Green Economy Winner untuk sektor (Finance - Bank Sector) Dan masih banyak pencapaian lainnya. Jika Anda mencari tempat untuk berkembang, berkontribusi, dan menjadi bagian dari transformasi industri perbankan Indonesia, inilah saatnya #SuksesBarengMega

AIB

aib.ie

We're here to keep you updated on AIB Group news, financial services industry insights, expert business reports and all the latest AIB career opportunities. We are one of Ireland’s major retail banks serving personal, business and corporate customers. We offer a range of banking products and services such as mortgages, savings and business banking. We have a customer centric view, always putting the customer first and supporting our customers at every stage. We have over 2.3m million customers using our multifaceted service. We provide our customers with a diverse range of contact channels; through our branches, commercial centres and our direct channels, such as AIB internet and telephone banking, self-service banking and our award-winning mobile banking app. AIB has a presence in Northern Ireland through its community-based full service bank, AIB NI, and in Britain where AIB GB serves its target audience of SMEs, owner-managed businesses and professional firms. EBS is also now part of the AIB Group and offers mortgage and deposit products and services from its own branch network. This is a public channel so never post your personal or account details. AIB provides banking related services in Ireland and all AIB content is intended for use in Ireland. Information is correct at time of posting and may be subject to change. No comments made by any employee, agent or contractor of AIB or any user should be construed as financial, investment or other specialist advice or as recommendations. AIB is not liable for any comments/postings on this channel. AIB Social Media Terms of Use and Privacy Statement apply https://aib.ie/social/social-media-privacy AIB and AIB Group are registered business names of Allied Irish Banks, p.l.c. Registered Office

Crédit Mutuel

creditmutuel.com

Un modèle mutualiste au service des clients et des salariés. Réseau bancaire mutualiste constitué de 2124 Caisses locales le Crédit Mutuel se compose de 18 fédérations régionales, couvrant tout le territoire français. Société de personnes et non de capitaux, le Crédit Mutuel n’est pas coté en Bourse. Sa stratégie est ainsi dégagée de la recherche de la seule rentabilité à court terme, au profit d’un développement pensé sur le long terme. Son objectif central : rendre un service de qualité au coût le plus juste à tous ses sociétaires. Son organisation décentralisée favorise ainsi la qualité de service aux clients et la réactivité, par des circuits de décision courts. Reconnu à la fois par ses clients et les professionnels de la finance, le Crédit Mutuel décroche régulièrement des titres qui confortent son modèle mutualiste et ses valeurs de solidarité, responsabilité, égalité, proximité et responsabilité sociale portées par les salariés et les clients- sociétaires. Au-delà de son réseau, le Crédit Mutuel constitue un Groupe qui comprend également plusieurs filiales dont certaines sont implantées à l’étranger. Les nouveaux collaborateurs du Crédit Mutuel apprécient tout particulièrement : - un circuit de recrutement court, axé sur des entretiens évaluant notamment la personnalité et la motivation ; - un parcours d’intégration précis, suivi par la fonction Ressources Humaines. Les salariés apprécient tout particulièrement : - le Système d’Information au service du développement commercial ; - un management au travers d’objectifs collectifs ; - des démarches et outils de gestion des carrières et des compétences facilitant la progression dans l’entreprise ; - la qualité des formations de préparation ou d’accompagnement des changements d’emploi ; - la diversité des opportunités d’évolution, principalement commerciale, sur tous les marchés, dans toutes les entités du Groupe.

Federal Bank

cb federalbank.co.in

Federal Bank, one of the leading private sector banks with presence across the country, began its journey from humble backgrounds to reach the stature of an institution with national prominence & character. With a rich legacy of 7 decades, the Bank aspires to be the most admired Bank in the country and fueling its dreams are the 19 million and growing customer base who have always been loyal to the Bank as the Bank is to them. Headquartered in Aluva, Kerala, the Bank’s scrips are widely held and are listed in the Bombay Stock Exchange and National Stock Exchange in India. The Bank’s global depository receipts are listed on the London Stock Exchange. The Bank has built its empire on the twin values of ethics and excellence, and this has propelled the Bank throughout its journey. Over 1,588 branches, 2079+ ATMs/ Cash Recyclers and a committed, experienced & energetic workforce, Federal Bank now has its presence across the nation. To service the NRIs, who have been its pillars of strength, the Bank operates Representative Offices at Dubai and Abu Dhabi in the UAE. The Bank today handles one fifth of the total NR remittance to the country and this is testimony to its relationship with the NR diaspora. The Bank also has an IFSC Banking Unit (IBU) in Gujarat International Finance Tec-City (GIFT City). Transformation is inevitable and for Federal Bank it has been no different. The Bank believes in transforming itself, keeping its principles intact, to match the beats of the industry and the expectations of its stakeholders. Technology is the new buzzword, and it has left its indelible mark in the banking industry as well. Disclaimer: Federal Bank advices against sharing any confidential information on social media handles of the Bank

PKO Bank Polski

cb pkobp.pl

We are the largest bank in Poland and one of the largest financial institutions in the region. Our strength rests on three strong pillars: the retail, the corporate and the investment segment. Irrespective of the unique nature of each of those areas, what joins them is the undivided attention they pay to the needs of their customers and clients, and their pursuit of superlative quality in customer service. Consistent campaigning established the “PKO Bank Polski” brand as a virtual guarantee of the right banking partner choice, one that not only delivers the relevant products and services, but also provides capable support in financial and business decisions. The professionalism and the experience of our advisers help them meet their customers’ expectations and to offer them the best available solutions. Though traditionally dedicated to retail customers, over the years PKO Bank Polski has also become a corporate finance leader of the Polish market. As at the end of 2012, the number our corporate clients exceeded 12,000. For years now, our corporate banking segment has participated in projects of major importance for the entire Polish economy. We have financed major investment projects, engaged in restructuring and recovery processes and have supported regional development through solutions dedicated to local government units. In 2012 we continued in activity that perpetuated our image of a true partner of the Polish enterprise and local government sectors, which we gained during the first wave of the financial crisis. At the heart of our corporate offer is our ability to engineer comprehensive solutions out of the products of the Bank and its Group Companies (factoring, leasing) of relevance to the differing needs of the various size companies: from small entities in the early stages of development to the largest corporates.

Commerzbank AG

cb commerzbank.com

Commerzbank is the leading bank for the German Mittelstand and a strong partner for around 24,000 corporate client groups. In addition, it supports private and small-business customers in Germany with more than €400 billion assets under management. The Bank’s two Business Segments – Private and Small-Business Customers and Corporate Clients – offer a comprehensive portfolio of financial services. Commerzbank transacts approximately 30% of Germany’s foreign trade and is present internationally in more than 40 countries in the corporate clients’ business. The Bank focusses on the German Mittelstand, large corporates, and institutional clients. As part of its international business, Commerzbank supports clients with a business relationship to Germany, Austria, or Switzerland and companies operating in selected future-oriented industries. In the Private and Small-Business Customers segment, the Bank is at the side of its customers with its brands Commerzbank and comdirect: online and mobile, in the advisory centre, and personally in its branches. Its Polish subsidiary mBank S.A. is an innovative digital bank that serves approximately 5.7 million private and corporate customers, predominantly in Poland, as well as in the Czech Republic and Slovakia.

Caisse d’Epargne

caisse-epargne.fr

Banques coopératives, les Caisses d'Epargne conjuguent depuis 1818 confiance, solidarité et modernité. Deuxième réseau bancaire en France, les 16 Caisses d'Epargne régionales comptent parmi les premières banques de leur région. Elles accompagnent tous les acteurs économiques et sont leaders du financement du secteur public, du logement social et de l'économie sociale. Au total, les Caisses d'Epargne comptent aujourd'hui 4,8 millions de sociétaires et 20,6 millions de clients, gérés par les 4 182 agences bancaires et l’agence Mon banquier en ligne.

CIBC

cb cibc.com

CIBC is here to help all our clients reach their goals. We know the importance of reliable financial products and services, and we’re dedicated to providing them in a way that lets you bank however you want, whenever you want. With innovative tools designed around your priorities and a team fully focused on your success, you’ll get the insights you need to get even closer to achieving your goals. This culture of innovation and shared values of trust, teamwork and accountability are why we’ve been named a top employer in Canada. They’re also why a career at CIBC is more than a job—it’s an opportunity to grow and work alongside some of the brightest in Canada. La Banque CIBC est là pour aider tous nos clients à atteindre leurs objectifs. Nous connaissons l'importance de produits et services financiers fiables, et nous nous engageons à les fournir d'une manière qui vous permette d'effectuer vos opérations bancaires comme vous le souhaitez, quand vous le souhaitez. Avec des outils innovants conçus autour de vos priorités et une équipe entièrement centrée sur votre réussite, vous obtiendrez les informations dont vous avez besoin pour vous rapprocher encore plus de vos objectifs. Cette culture de l'innovation et les valeurs partagées de confiance, de travail d'équipe et de responsabilité sont la raison pour laquelle nous avons été nommés l'un des meilleurs employeurs au Canada. C'est aussi pourquoi une carrière à la Banque CIBC est plus qu'un emploi : c'est une occasion de grandir et de travailler aux côtés de certaines des personnes plus brillantes au Canada.

Societe Generale

cb societegenerale.com

Societe Generale is one of the leading European financial services groups. Based on a diversified and integrated banking model, the Group combines financial strength and proven expertise in innovation with a strategy of sustainable growth. Committed to the positive transformations of the world’s societies and economies, Societe Generale and its teams seek to build, day after day, together with its clients, a better and sustainable future through responsible and innovative financial solutions. Active in the real economy for over 150 years, with a solid position in Europe and connected to the rest of the world, Societe Generale has over 117,000 members of staff in 66 countries and supports on a daily basis 25 million individual clients, businesses and institutional investors around the world by offering a wide range of advisory services and tailored financial solutions. The Group is built on three complementary core businesses: - French Retail Banking which encompasses the SG and Boursorama brands. Each offers a full range of financial services with omnichannel products at the cutting edge of digital innovation; - International Retail Banking, Insurance and Financial Services, with networks in Africa, Central and Eastern Europe and specialised businesses that are leaders in their markets; - Global Banking and Investor Solutions, which offers recognised expertise, key international locations and integrated solutions. Societe Generale is included in the principal socially responsible investment indices: DJSI (Europe), FTSE4Good (Global and Europe), Bloomberg Gender-Equality Index, Refinitiv Diversity and Inclusion Index, Euronext Vigeo (Europe and Eurozone), STOXX Global ESG Leaders indexes, and the MSCI Low Carbon Leaders Index (World and Europe).

Loading…

NEWS

CIT Bank CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

February 16, 2026 11:53 AM

Resecurity Showcases AI-Powered Cybersecurity Solutions at AI Everything MEA Egypt 2026

CAIRO--(BUSINESS WIRE)-- Resecurity, a U.S.-based cybersecurity and intelligence company protecting Fortune 100 companies and government...

Read Article

February 02, 2026 08:00 AM

CIT Bank review (2026): Fee-free accounts with market-leading interest rates

A division of First Citizens Bank, CIT Bank operates exclusively online. It offers a variety of personal and commercial banking products and services.

Read Article

December 08, 2025 08:00 AM

Citi to Launch Crypto Custody Next Year

The bank believes it has an advantage in being able to bridge traditional and digital assets on one platform.

Read Article

December 08, 2025 08:00 AM

Parma Heights shores up its IT security following cyberattack

Like all local governments across the state, Parma Heights is currently in the process of approving cybersecurity policies.

Read Article

December 01, 2025 08:00 AM

JPMorgan Chase, Citi, Morgan Stanley and Other Major US Banks Impacted by Data Breach at SitusAMC

A data breach at SitusAMC has affected several major US banks after attackers breached the finance technology company's network.

Read Article

November 30, 2025 08:00 AM

City Bank transforming everyday banking for millions

From paying bills to transferring funds, City Bank is showing how mobile banking can simplify daily life, reduce costs, and help build a...

Read Article

November 29, 2025 08:00 AM

JPMorgan Chase, Citi and Morgan Stanley Customers Impacted As Massive Third-Party Data Breach Hits Banks: Report

A cyberattack on a New York-based tech vendor has led to the exposure of sensitive customer data, including records belonging to three of...

Read Article

November 24, 2025 08:00 AM

Hackers steal sensitive data from major banking industry vendor

One of the banking industry's biggest vendors is responding to a cyberattack that has compromised some of its clients' sensitive data.

Read Article

September 27, 2025 07:00 AM

Stone Mountain mayor files petition challenge city council vote to remove her from office

Mayor Beverly Jones challenges her removal amid claims of taking bank control.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18577

SUMMARY

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-10848

SUMMARY

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 7)

cvss3

Base Score: 7.0

Complexity: HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Impact Score

4.7

Exploitability

2.2

REFERENCES

CVE-2026-9856

SUMMARY

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 7.1)

cvss3

Base Score: 7.1

Complexity: LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Impact Score

4.2

Exploitability

2.8

REFERENCES

CVE-2026-65321

SUMMARY

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL syntax causes the parser to terminate the string literal prematurely, enabling data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 9.8)

cvss3

Base Score: 9.8

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

cvss4

Base Score: 9.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

5.9

Exploitability

3.9

REFERENCES

CVE-2026-10774

SUMMARY

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keys_destroy() guarded the matching psa_destroy_key() with CONFIG_BT_MESH_V1d1. That Kconfig symbol was removed when explicit Mesh 1.0.1 support was dropped, so the destroy branch became permanently dead code and the import is never balanced by a destroy. The imbalanced teardown is reached every time subnet keys are destroyed: deleting a subnet (Config Server NetKey Delete), completing a Key Refresh Procedure (which retires the old key set), and resetting/re-provisioning the node. The over-the-air triggers are processed only under the node's device key, so they are exercisable by the provisioner or network administrator that owns the node, reachable over the Bluetooth Mesh network. With the default CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT of 16, repeated add/delete or key-refresh cycles exhaust the shared PSA key-slot pool after roughly a dozen rounds. Once exhausted, bt_mesh_private_beacon_key() and thus subnet creation fail: the node can no longer add subnets or complete key refresh, and other PSA crypto consumers on the device may be starved, until the device is rebooted. The fix aligns the destroy guard with the import guard (CONFIG_BT_MESH_PRIV_BEACONS) so each slot is freed.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 2.4)

cvss3

Base Score: 2.4

Complexity: LOW

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

0.9

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…