CVE-2026-72506 Overview
CVE-2026-72506 affects VoiceTra, a speech translation application provided by the National Institute of Information and Communications Technology (NICT). The vulnerability stems from an incorrectly specified destination in a communication channel [CWE-941]. Attackers can redirect user traffic to servers under their control. This redirection can lead to theft of user-supplied input data or the display of manipulated translation results. Exploitation requires user interaction over the network, making phishing or malicious link delivery viable attack methods. NICT published the advisory through JVN on August 13, 2026.
Critical Impact
Successful exploitation enables attackers to intercept translation inputs and serve falsified results by directing the VoiceTra client to an attacker-controlled endpoint.
Affected Products
- VoiceTra application provided by the National Institute of Information and Communications Technology (NICT)
- Refer to the JVN Security Advisory for affected version details
- See the NICT Publicity Announcement for vendor guidance
Discovery Timeline
- 2026-08-13 - CVE CVE-2026-72506 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-72506
Vulnerability Analysis
CVE-2026-72506 is classified under [CWE-941] Incorrectly Specified Destination in a Communication Channel. VoiceTra establishes a communication channel to a translation backend, but the destination specification allows redirection to an unintended server. An attacker who can influence the destination — for example, by delivering a crafted configuration, link, or context that the user acts upon — can cause the client to transmit voice or text input to an attacker-controlled service.
The consequence is twofold. First, sensitive user input intended for legitimate translation processing is exposed to the attacker. Second, the attacker returns arbitrary translation results to the user, undermining the integrity of the displayed output. Because the affected data flow involves speech and text that users assume is handled privately, disclosure has direct confidentiality implications.
Root Cause
The root cause is improper validation or configuration of the communication channel destination within the VoiceTra client. The application accepts or resolves a destination value that is not sufficiently constrained to the legitimate NICT translation endpoints, permitting substitution with an attacker-specified server.
Attack Vector
The attack vector is Network with required user interaction. An attacker prepares an environment or artifact that causes VoiceTra to route traffic to a malicious host. When the user performs a translation action, the client sends the input to that host and displays whatever response the attacker returns. No authentication is required to stage the attack. Refer to the JVN Security Advisory for vendor-provided technical detail. Public proof-of-concept code has not been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-72506
Indicators of Compromise
- Outbound VoiceTra client connections to domains or IP addresses outside of NICT's documented translation service infrastructure.
- Unexpected TLS certificates presented to VoiceTra sessions that do not match the expected NICT service certificate chain.
- Translation results that are inconsistent, nonsensical, or contain injected content unrelated to the user's input.
Detection Strategies
- Monitor network telemetry from mobile and workstation fleets for VoiceTra process traffic destined to non-NICT endpoints.
- Baseline expected VoiceTra destination FQDNs and alert on deviations, particularly newly registered or low-reputation domains.
- Correlate DNS resolution logs with VoiceTra application usage to identify hijacked or poisoned name resolution paths.
Monitoring Recommendations
- Enable proxy or network sensor logging for HTTP and TLS SNI values associated with VoiceTra client traffic.
- Retain full network flow records for translation application traffic to support retrospective hunts once vendor indicators are published.
- Track NICT News Update advisories for additional detection artifacts.
How to Mitigate CVE-2026-72506
Immediate Actions Required
- Update VoiceTra to the fixed version distributed by NICT as referenced in the JVN Security Advisory.
- Instruct users to avoid opening untrusted links, configuration files, or QR codes that claim to modify VoiceTra behavior.
- Verify that endpoint and mobile device management policies enforce installation of the patched VoiceTra build.
Patch Information
NICT has published guidance for this issue. Consult the NICT Publicity Announcement and the JVN Security Advisory for the fixed version and upgrade instructions. Apply the vendor-supplied update on all devices running VoiceTra.
Workarounds
- Restrict use of VoiceTra on managed devices until the patched version is deployed.
- Use network egress controls or DNS policies to permit VoiceTra traffic only to documented NICT translation service endpoints.
- Educate users to treat unexpected translation output as suspicious and to report anomalies to the security team.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
