Is CVE-2026-24075 being exploited in the wild?

At the time of the last update, CVE-2026-24075 was not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS probability of exploitation in the next 30 days is 0.06 percent. Recheck the catalog regularly.

How do I fix CVE-2026-24075?

Upgrade Qualcomm Wsa8845h Firmware to the fixed version named in the vendor advisory listed under Technical References. If you cannot patch right away, limit network access to the affected component and monitor it closely until you can.

How serious is CVE-2026-24075?

It is rated high with a CVSS base score of 7.8. The flaw needs local or adjacent access, needs some level of access, and needs no user interaction. In CTEM terms, combine that with how exposed and important the affected system is to set the real priority.

CVE-2026-24075: Qualcomm Wsa8845h Firmware Security Vulnerability (CVSS 7.8)

Quick answer

Direct answer

CVE-2026-24075 is a high severity security vulnerability in Qualcomm Wsa8845h Firmware with a CVSS score of 7.8. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.

Risk scores

CVSS base score

7.8HIGH

EPSS probability

0.06%

Higher than 0 percent of all CVEs

CISA KEV

Not listed

CVSS metric	What it means
Attack vector (AV:L)	Local access needed
Attack complexity (AC:L)	Low complexity
Privileges required (PR:L)	Low privileges required
User interaction (UI:N)	No user interaction
Scope (S:U)	Scope unchanged
Confidentiality (C:H)	High confidentiality impact
Integrity (I:H)	High integrity impact
Availability (A:H)	High availability impact

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

About Qualcomm Wsa8845h Firmware

CVE-2026-24075 affects Qualcomm Wsa8845h Firmware, a product from Qualcomm. Before acting, confirm where Qualcomm Wsa8845h Firmware runs in your estate, who owns it and whether it is reachable from the internet, because exposure decides real risk more than the score alone.

What the flaw is

In plain terms: Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.

Based on its CVSS vector, the flaw needs local or adjacent access, needs some level of access, and needs no user interaction. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.

Affected versions and timeline

Field	Detail
Product	Qualcomm Wsa8845h Firmware
Affected versions	Wsa8845h Firmware all listed versions; Aqt1000 Firmware all listed versions; Cologne Firmware all listed versions; Fastconnect 6200 Firmware all listed versions; Fastconnect 6700 Firmware all listed versions; Fastconnect 6800 Firmware all listed versions; Fastconnect 6900 Firmware all listed versions; Fastconnect 7800 Firmware all listed versions; Iqx5121 Firmware all listed versions; Iqx7181 Firmware all listed versions; Qca0000 Firmware all listed versions; Qca6391 Firmware all listed versions
Published	Sep 17, 2026
Last modified	Sep 22, 2026
Added to CISA KEV	Not listed
Assigning CNA	product-security@qualcomm.com

How to detect it

Inventory every instance of Qualcomm Wsa8845h Firmware and record the running version against the affected range above.
Check external attack surface scans for internet facing instances of the component.
Review logs on affected systems for unusual requests, errors or new processes around the vulnerable function.
Confirm with an authenticated vulnerability scan once your scanner has a check for this CVE.

How to fix it

Apply the fixed version of Qualcomm Wsa8845h Firmware named in the vendor advisory.
If patching must wait, restrict network access to the affected service and put it behind authentication or a web application firewall rule.
Rescan after the change to prove the exposure is gone, then close the ticket.

CTEM action plan

CTEM stage	What to do for this CVE
Scope	Add every business service that depends on Qualcomm Wsa8845h Firmware to the current CTEM cycle.
Discover	Find all instances, including shadow and cloud deployments, and record versions and exposure.
Prioritize	Rank using EPSS and CVSS together with asset exposure and business impact.
Validate	Confirm the flaw is reachable and exploitable in your environment and that compensating controls work.
Mobilize	Assign the fix to the asset owner with a due date matched to the priority, then verify closure.