CVE-2026-79680Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module

4.5MediumCVSS base score
0.34%Exploitation in 30 daysEPSS · top 72% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.

Timeline

2026
25 Aug 2026
25 Aug 2026
ID reserved
By Qt
24 Sept 202630 days later
24 Sept 2026· 30 days later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-79680, by who scored it
Scored by	CVSS	Score	Vector
QtCNA (assigner)	4.0	Medium4.5	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L
NVDNVD · Awaiting Analysis	4.0	Medium4.5	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:X

EPSS (exploitation in 30 days): 0.34% · top 72% of all CVEs (12 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.5.

Affected products

qt · qt
- affected 6.4.0 – < 6.8.9
- affected 6.9.0 – < 6.11.3

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-79680](https://cveledger.app/badge/CVE-2026-79680.svg)](https://cveledger.app/cve/CVE-2026-79680)

Record last updated 24 Sept 2026, 12:18 UTC.