CVE-2026-25826

Name of the Vulnerable Software and Affected Versions Keyfactor SignServer versions prior to 7.6.0

Description An issue exists where the ATTRIBUTESFILE attribute in PKCS11CryptoToken can be configured to point to a readable file that is not recognized as a valid attribute file. When this occurs, the system generates an error that includes the full content of the file within the application server log. An attacker with SignServer administrative privileges and access to the server logs, such as through remote syslog shipping, can exploit this to read files accessible by the local JBoss user.

Recommendations Update Keyfactor SignServer to version 7.6.0 or later.