The vulnerability identified as CVE-2026-59639 affects Bouncy Castle for Java (BC-JAVA) in versions prior to 1.85 and versions in the range 2.73.0 up to but not including 2.73.12. The CMS verifySignatures function returns a successful verification result even when the SignedData structure contains zero signers, violating proper cryptographic signature verification principles (CWE-347). This flaw also impacts Bouncy Castle for Java LTS before 2.73.12 and Bouncy Castle for Java FIPS in specified versions. The CVSS 4.0 base score is 8.7, indicating a high severity due to network attack vector, low attack complexity, no privileges or user interaction required, and high impact on integrity.

Successful exploitation of this vulnerability allows an attacker to bypass signature verification checks by presenting SignedData with no signers, potentially causing applications relying on BC-JAVA to accept unsigned or improperly signed data as valid. This undermines data integrity and authenticity guarantees provided by cryptographic signatures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's advisories for updates and apply patches once available. Until then, avoid relying on the affected verifySignatures method for critical signature validation or implement additional verification controls.