This vulnerability (CVE-2026-59651) in Bouncy Castle for Java (BC-JAVA) arises because the BKS keystore accepts legacy keystore versions that use a 16-bit integrity MAC key, which is considered cryptographically weak (CWE-326). The affected versions are all releases before 1.85 and LTS releases from 2.73.0 up to but not including 2.73.12. The weakness in the MAC key compromises the integrity protection of the keystore data. The CVSS 4.0 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed, with high impact on integrity.

The vulnerability weakens the integrity protection of the BKS keystore by using an insufficiently strong 16-bit MAC key. This could allow an attacker to tamper with keystore contents without detection, potentially leading to unauthorized modifications of cryptographic keys or certificates stored within. The impact is primarily on data integrity, which can undermine the security guarantees of applications relying on the affected Bouncy Castle versions for cryptographic operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary fix is indicated in the provided data. Users should monitor the official Bouncy Castle advisories for updates and consider upgrading to versions 1.85 or later, or 2.73.12 or later for LTS, once confirmed fixed. Until then, avoid using legacy BKS keystore versions with weak MAC keys if possible.