CVE-2026-1193449.1CriticalCWE-346

CVE-2026-119344: Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

ultravioletrs · cocos

Affected: ultravioletrs cocos · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

23rd percentile

050100

Higher than 23% of scored CVEs

9.1CriticalCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. This vulnerability is addressed in 0.9.0. However, this vulnerability can't be patched in source code alone, since the vulnerability arises from the confidential computing threat model itself.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

ultravioletrs · cocos<= 0.8.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Origin Validation Error · Access Control
Vendor: ultravioletrs
Published: November 2026
Band: Unlikely (under 1%), November 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-119344 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.