PatchTheCVEarm vulnerabilities
Recent CVEs affecting arm products. 5 tracked.
arm has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-04-02. Highest priority: CVE-2026-34877 (score 48/100).
- CVE-2026-34877 CRITICAL 9.8 UPGRADE DOWNGRADE An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0
- CVE-2026-34872 CRITICAL 9.1 UPGRADE DOWNGRADE An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0
- CVE-2026-34871 MEDIUM 6.7 UPGRADE UPGRADE An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0
- CVE-2026-25835 HIGH 7.7 UPGRADE DOWNGRADE Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
- CVE-2025-66442 MEDIUM 5.1 UPGRADE UPGRADE In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) tha
FAQ
How do I fix arm vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is arm being exploited right now?
None of the tracked arm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which arm CVE should I patch first?
CVE-2026-34877 currently ranks highest (48/100): An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0.