CVE-2025-26488 Improper input validation in XML Management service in Infinera MTC-9

High 7.5 Published 8 Dec 2025 Updated 8 Dec 2025

Remote unauthenticated attackers can crash the Infinera MTC-9 service and force a reboot via crafted XML payloads, causing denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-26488?

CVE-2025-26488 is a high-severity denial of service vulnerability in Infinera MTC-9, published on 8 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.

Weakness: CWE-20

Which versions are affected by CVE-2025-26488?

It affects 1 product.

Products include Nokia Infinera Mtc-9 Firmware.

How do I fix CVE-2025-26488?

No fix has been published for CVE-2025-26488 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-26488 being exploited?

There is no known exploitation of CVE-2025-26488 in the wild and no public exploit code.

Sources

Also known as GHSA-mj79-69mf-x9m9.