CTERA Security Advisory CTERA-SA-2026-06-11
Vulnerability Description
A race condition in how the Linux kernel sets up IPv4 TCP connections could let a remote, unauthenticated attacker corrupt kernel memory and possibly run code. CTERA Edge Filer and CTERA Portal both run affected Linux kernels.
Vulnerability Details
Publication Date: Nov 8 2026
CVSS (Common Vulnerability Scoring System) 3.1 score of 9.8
QVSS (Qualys Vulnerability Scoring System) score of 7.2
Affected CTERA Products
CTERA Edge Filers:
7.11.x: All versions before, and including, 7.11.5100.39
7.12.x: All versions before, and including, 7.12.5400.29
7.13.x: All versions before, and including, 7.13.6000.27
CTERA Portal:
All versions. Fixed versions are expected is next few days.
Analysis
This vulnerability is considered critical, as portals edge filers running affected, unpatched versions may remain exposed to remote exploitation, putting your organization's infrastructure, data, and business continuity at significant risk.
There are reports of suspected scanning since November 2, 2026. As of this advisory, no public exploit has been confirmed, the issue is not on the CISA Known Exploited Vulnerabilities list, and CTERA does not know of any exploitation against CTERA customers.
Workaround
Until the update is installed, CTERA recommends:
- Limit network access to portal servers so that only trusted networks and the required edge filer and client addresses can reach them.
- Where possible, put portal behind a load balancer or reverse proxy that terminates TCP connections, so internet traffic doesn’t reach the portal kernel directly.
- Watch for unexpected portal server reboots or kernel crashes, and report any to CTERA Support.
Permanent Solution
CTERA Edge Filers:
7.11.x: All versions from 7.11.5100.40 and later
7.12.x: All versions from 7.12.5400.39 and later
7.13.x: All versions from 7.13.6000.29 and later
Customers who have not upgraded to one of these versions, or a higher version, are advised to schedule a short maintenance window for installing this patch version on their edge filers.
CTERA Portal:
All versions. Fixed versions are expected is next few days.
CTERA-hosted (SaaS) portals: CTERA will apply the update to hosted environments. No customer action is needed.