Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N N N L 2.1 .0047 39.3 —
AFFECTED Product Versions Fixed GigaSpire 26.1.0 – —
TIMELINE Aug 13 Reserved by VulDB Aug 13 Published (CNA: VulDB) Oct 15 DISPUTED — CVE-2026-19745 (Calix GigaSpire). Record marked disputed.
A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The existence of this vulnerability is still disputed at present. The vendor explains: "We reproduced the reported request pattern. The observed delay results from expected input-timeout handling while the handler waits for input data. We did not observe a backend crash, resource exhaustion, service instability, or loss of EWI availability, and the interface remained accessible during and after testing."
| Date | Event | Detail |
|---|---|---|
| August 13, 2026 | Reserved | Reserved by VulDB |
| August 13, 2026 | Published | Published (CNA: VulDB) |
| October 15, 2026 | DISPUTED | DISPUTED — CVE-2026-19745 (Calix GigaSpire). Record marked disputed. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Calix | GigaSpire | — | 26.1.0 | — |
Authoritative record: CVE-2026-19745 at cve.org
Vendors: calix
Weaknesses: CWE-404
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19745 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
