Vulnerability · Published Oct 27, 2026 · Assigned by Moxa

CVE-2026-111459Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)

High 7.6

In plain English

A high-severity improper certificate validation in Moxa Remote Connect Suite (MRC Client) from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)7.6High

Exploit odds (30 days)0.2%top 93.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.

Affected products (as reported)

Vendor	Product	Versions
Moxa	Moxa Remote Connect Suite (MRC Client)	1.0.0 – through 4.2.0

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client vendor-advisory