CVE-2026-49435: Keysight IxChariot Endpoint RCE Vulnerability

CVE-2026-49435 Overview

CVE-2026-49435 is a stack-based buffer overflow [CWE-121] affecting Keysight IxChariot Endpoint and associated products. An unauthenticated remote attacker can send a specially crafted packet to trigger the overflow and execute arbitrary code with administrative privileges on the target host. The flaw is reachable over the network without any user interaction, which makes it viable for automated exploitation across exposed test and measurement environments. Keysight has published a security advisory, and CISA has released a corresponding CSAF document describing the impact and affected components.

Critical Impact
Unauthenticated remote code execution with administrative privileges via a crafted network packet.

Affected Products

Keysight IxChariot Endpoint
Keysight Hawkeye (associated deployment)
Keysight IxProbe (associated deployment)

Discovery Timeline

2026-08-04 - CVE-2026-49435 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-49435

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in the packet-handling logic of the IxChariot Endpoint service. The service listens on the network for measurement and control traffic used to orchestrate performance tests between endpoints. When the service parses a specially crafted packet, it writes attacker-controlled data past the boundary of a fixed-size stack buffer.

The overflow overwrites adjacent stack structures, including the saved return address and any structured exception handlers on Windows builds. An attacker who controls the overflow payload can redirect execution to a chosen location and run arbitrary code within the process context. The IxChariot Endpoint service typically runs with administrative privileges to perform low-level network measurements, so successful exploitation yields administrative code execution on the host.

Root Cause

The root cause is missing bounds validation on network-supplied data before it is copied into a fixed-length stack buffer. The parser trusts a length field, or copies until a delimiter, without verifying that the destination buffer can hold the input. This condition maps directly to [CWE-121] Stack-based Buffer Overflow.

Attack Vector

Exploitation requires only network reachability to the IxChariot Endpoint service. No authentication, credentials, or user interaction are required. An attacker sends a single crafted packet to the listening port and triggers the overflow. In laboratory or enterprise networks where IxChariot endpoints are deployed on management VLANs, an internal attacker or compromised host can pivot to any reachable endpoint.

No public proof-of-concept exploit is available at the time of publication. Refer to the Keysight Security Advisory and the CISA CSAF Document for authoritative technical detail.

Detection Methods for CVE-2026-49435

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the IxChariot Endpoint service process.
New child processes spawned by the IxChariot Endpoint service, particularly command interpreters such as cmd.exe or powershell.exe.
Outbound connections initiated by the IxChariot Endpoint process to unfamiliar external hosts following inbound test traffic.

Detection Strategies

Deploy network signatures that flag oversized or malformed packets directed at IxChariot Endpoint listening ports.
Alert on process-lineage anomalies where the IxChariot Endpoint service spawns interactive shells, script hosts, or persistence utilities.
Correlate service crash events with inbound traffic to the endpoint to identify probing or failed exploitation attempts.

Monitoring Recommendations

Collect endpoint process telemetry and Windows event logs from all hosts running IxChariot components and forward to a centralized analytics platform.
Monitor for exposure of IxChariot Endpoint ports to untrusted network segments and internet-facing interfaces.
Track file integrity on IxChariot install directories to identify tampering or unauthorized binary replacement.

How to Mitigate CVE-2026-49435

Immediate Actions Required

Apply the fixed version identified in the Keysight Security Advisory to all IxChariot Endpoint, Hawkeye, and IxProbe deployments.
Inventory every host running IxChariot Endpoint components, including embedded probes and copper taps, and prioritize patching those reachable from user or production networks.
Restrict inbound access to IxChariot Endpoint listening ports using host-based and network firewalls until patching is complete.

Patch Information

Keysight has published fixed builds and mitigation guidance in the vendor advisory. Refer to the Keysight Security Advisory and the corresponding CISA CSAF Document for version numbers, download locations, and upgrade procedures. Full product context is available in the Keysight IxChariot Overview, Keysight Hawkeye Overview, and Keysight IxProbe Overview.

Workarounds

Isolate IxChariot endpoints on a dedicated management VLAN with strict ACLs limiting sources to authorized test consoles.
Stop or disable the IxChariot Endpoint service on hosts that are not actively running measurements until the patch is applied.
Block inbound traffic to the IxChariot Endpoint listening port from all untrusted networks at the perimeter.

bash

# Example: restrict IxChariot Endpoint access to a management subnet on Windows
netsh advfirewall firewall add rule name="Block IxChariot External" ^
  dir=in action=block program="%ProgramFiles%\Ixia\IxChariot\Endpoint\endpoint.exe" ^
  enable=yes profile=any

netsh advfirewall firewall add rule name="Allow IxChariot Mgmt Subnet" ^
  dir=in action=allow program="%ProgramFiles%\Ixia\IxChariot\Endpoint\endpoint.exe" ^
  remoteip=10.10.20.0/24 enable=yes profile=any