BlastShield is BlastWave’s Zero Trust network access solution for OT environments. It uses a software-defined perimeter approach to help organizations reduce risk from stolen credentials, simplify access control, cloak critical systems, secure remote access, and segment OT networks.

How does BlastShield help stop OT attacks before they start?

BlastShield helps stop OT attacks before they start by requiring authentication and authorization before users or devices can access protected systems. It combines network cloaking, phishing-resistant access, secure remote connectivity, and software-defined segmentation to reduce exposure and limit lateral movement.

What is the BlastShield Security Gateway?

The BlastShield Security Gateway is a hardware-independent software package that can be installed in a VM, container, or pre-installed appliance. It delivers network cloaking, terminates secure remote access connections, and uses software-defined segmentation to secure OT networks.

What is the BlastShield Client?

The BlastShield Client is a Zero Trust client for secure OT connectivity. It supports Windows, Mac, and Linux, allowing authorized users to connect securely to approved OT systems without disrupting existing operations.

What is the BlastShield Authenticator?

The BlastShield Authenticator provides passwordless authentication using a QR code challenge-response, localized biometric authentication, and the device keystore. It is designed to prevent credential theft, phishing, and AI-powered attacks while keeping a human in the loop.

BlastAccess is BlastWave’s secure remote desktop connectivity solution. It provides high-performance remote access with session recording, while removing open ports and reducing risks from browser hijacking, password theft, PAM weaknesses, and web-based RDP exposure.

What does the BlastShield Agent do?

The BlastShield Agent helps secure servers by requiring a verified BlastShield client before a connection can be made. It supports Windows, Mac, and Linux and helps turn protected servers into Zero Trust-controlled assets.

What does the BlastShield Orchestrator do?

The BlastShield Orchestrator manages real-time policy enforcement across the network. It can be deployed on-premises or in the cloud and helps ensure users and devices connect only to the systems they are authorized to access.

How does BlastShield support network cloaking?

BlastShield supports network cloaking by requiring users and devices to authenticate and authorize before access is granted. This helps make protected systems non-discoverable to unauthorized users and reduces the value of reconnaissance.

How does BlastShield support OT network segmentation?

BlastShield supports OT network segmentation through software-defined access controls that divide the network into isolated segments. This limits lateral movement and helps contain the impact of a breach.

BW-SA-2026-001

← All Security Advisories

BW-SA-2026-001 · Version 1.0

Linux Kernel Use-After-Free Affecting BlastShield Orchestrator (CVE-2026-98432)

Critical

CVSS 3.1;

High

CVSS 4.0

CVE ID(s)

CVE-2026-98432

Last Updated

2026-10-29

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Affected Product

BlastShield Orchestrator

Published

2026-10-29

Weakness

CWE-416: Use After Free

Summary
Affected products
Details
Impact
Remediation
Workarounds
Exploitation status
References
Acknowledgments
Revision history

Summary

A use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling (CVE-2026-98432) affects all versions of the BlastShield Orchestrator. An attacker who can reach a listening TCP port on the orchestrator could send crafted traffic that crashes it or, potentially, executes code. BlastShield Gateways are not affected because they do not expose any TCP ports.

Exploitation from public networks is only possible when the external identity provider integration is enabled. BlastWave is releasing BlastShield 1.14.6 and 2.0.2, which include a patched Linux kernel, and recommends that all customers upgrade their orchestrators.

Affected Products

Product / Component

Affected Versions

Fixed Version

BlastShield Orchestrator 1.x

All versions before 1.14.6

1.14.6

BlastShield Orchestrator 2.x

All versions before 2.0.2

2.0.2

BlastShield Gateway

Not affected (gateways do not expose TCP ports)

Not applicable

Vulnerability Details

The BlastShield Orchestrator runs on the Linux kernel. CVE-2026-98432 is a race condition in how the kernel handles IPv4 options during the TCP connection handshake. Under certain timing conditions, the kernel can free memory holding IP option data while another processor is still using it to send a handshake reply. A second variant affects TCP request socket migration.

The flaw is in the upstream Linux kernel, not in BlastWave code. It was fixed upstream in kernel commit e3f33b0, and BlastWave's fixed releases ship a patched kernel.

Impact

An attacker who can reach a listening TCP port on the orchestrator over IPv4 could trigger the condition. The most likely outcome is a kernel crash that makes the orchestrator unavailable. This type of memory corruption may also enable more severe impact, including code execution.

Exposure depends on configuration:

External identity provider enabled: An unauthenticated attacker can exploit the issue from public networks. Customers in this configuration should treat this advisory as critical and upgrade as soon as possible.
External identity provider not enabled: The issue is not exploitable from public networks. Exploitation would require network access to the orchestrator from within the customer's environment. A malicious authenticated BlastShield user could also potentially exploit it.

BlastShield Gateways are not affected, and they continue to expose no TCP ports to the networks they protect. However, an orchestrator outage may disrupt functions that depend on it until it recovers.

Remediation

Upgrade the BlastShield Orchestrator to the fixed version for your release line. These releases include a patched Linux kernel that fixes the vulnerability:

BlastShield Orchestrator 1.x: upgrade to 1.14.6 or later
BlastShield Orchestrator 2.x: upgrade to 2.0.2 or later

Firmware is available through your usual update channel. See the release notes for upgrade steps. Customers running 1.x releases older than 1.14.x should upgrade directly to 1.14.6.

Customers with the external identity provider integration enabled should upgrade immediately; the release is planned for October 30, 2026. All other customers should upgrade in their next maintenance window. Gateways do not need to be updated for this issue.

Workarounds and Mitigations

Upgrading is the only fix. Until you can upgrade, these steps reduce risk:

Review user accounts: Remove or disable BlastShield accounts you no longer need, since an authenticated user could potentially exploit this issue.
Restrict network access: Limit which networks and hosts can reach the orchestrator, using firewall rules or access control lists. If the external identity provider integration is enabled, restrict inbound access to the narrowest practical set of sources.
Monitor for instability: Treat unexpected orchestrator restarts as a possible indicator of attempted exploitation, and report them to BlastWave support.

For customers who rely on the external identity provider integration, disabling it is not a practical workaround. These customers should prioritize the upgrade.

Exploitation Status

BlastWave is aware of an unpublished exploit for this vulnerability that targets multipath TCP (MPTCP) listeners. BlastShield does not use multipath TCP listeners, so that exploit does not apply to BlastShield. Our analysis indicates the vulnerability may also be exploitable through a standard listening TCP port, but no known exploits exist for that path.

BlastWave is not aware of active exploitation of this vulnerability against BlastShield. We will update this advisory if that changes.

References

Acknowledgments

This vulnerability was identified and fixed by the upstream Linux kernel community.

Revision History

Version

Date

Change

1.0

2026-10-29

Initial publication

Questions about this advisory? Email security@blastwave.com. To report a new vulnerability, see our Vulnerability Disclosure Policy.