Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-19746

CVE-2026-19746LOW

Calix GigaSpire traceroute.cmd denial of service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0047   39.3     —

AFFECTED
  Product    Versions  Fixed
  GigaSpire  26.1.0 –  —

TIMELINE
  Aug 13  Reserved by VulDB
  Aug 13  Published (CNA: VulDB)
  Oct 15  DISPUTED — CVE-2026-19746 (Calix GigaSpire). Record marked disputed.

CWE-404 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

Description

A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The vendor explains: "After reviewing the researcher's videos, we repeated the test using his described setup: the traceroute cancel request was sent while a second client was connected to the EWI. The second client remained connected and was not interrupted, and we did not observe a forced logout, session invalidation, or loss of EWI availability."

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 13, 2026	Reserved	Reserved by VulDB
August 13, 2026	Published	Published (CNA: VulDB)
October 15, 2026	DISPUTED	DISPUTED — CVE-2026-19746 (Calix GigaSpire). Record marked disputed.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Calix	GigaSpire	—	26.1.0	—

Weaknesses

CWE-404

References (4)

Authoritative record: CVE-2026-19746 at cve.org

Vendors: calix

Weaknesses: CWE-404

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19746 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.