PT-2026-110628

CVE-2026-109399

Published

2026-10-12

Updated

2026-10-18

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SWUpdate versions prior to 2026.05.2

Description An improper certificate validation issue exists in the crypto/swupdate cms verify openssl.c file. The system trusts untrusted X.509 certificates embedded in CMS SignedData during the chain building process. This allows an attacker who possesses a signing key from a sibling intermediate under the same root to embed that intermediate in the signature and install malicious updates.

Recommendations Update SWUpdate to a version newer than 2026.05.1.

Exploitability

Exploit

Fix

Impacts

Researchers

David Gstir

Richard Weinberger

Vendors

Affected products

Weakness enumeration

CWE-295: Improper Certificate Validation