CVE-2026-109399: Improper Certificate Validation in sbabic swupdate

CVE-2026-109399 describes an improper certificate validation vulnerability in SWUpdate through version 2026.05.1. The vulnerability exists in the crypto/swupdate_cms_verify_openssl.c file, where the software trusts untrusted X.509 certificates embedded in CMS SignedData for certificate chain building. An attacker who possesses a signing key from a sibling intermediate certificate under the same root CA can embed that intermediate certificate in the signature, bypassing proper validation and enabling the installation of malicious updates.

Successful exploitation could allow an attacker to install malicious software updates by exploiting the improper certificate validation mechanism. This undermines the integrity and authenticity guarantees of the update process, potentially leading to system compromise. The CVSS 4.0 score of 9.2 (critical) reflects the high impact due to network attack vector, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict update sources to trusted environments and monitor for updates from the vendor addressing this certificate validation issue.