CVE-2026-78323: Improper Certificate Validation in Red Hat Red Hat Certificate System 10

The vulnerability exists in the JSSTrustManager class of JSS, which fails to verify NSS trust flags when validating CA certificates. Consequently, certificates present in the NSS database but lacking TRUSTED_CA flags can be accepted as trust anchors for TLS connections. This issue can be exploited only in non-default configurations where certificate revocation checking is disabled, potentially allowing a man-in-the-middle attacker to forge certificates accepted by PKI client connections. The server-side TLS validation using JSSNativeTrustManager is unaffected. The flaw is mitigated by default revocation verification (certChainRevokeVerify) enabled on PKI client connections.

If certificate revocation checking is disabled, an attacker could perform man-in-the-middle attacks by forging certificates that are accepted as trusted, compromising confidentiality and partially integrity of TLS connections. The default configuration mitigates this risk by enabling revocation verification. There is no impact on availability. The server-side TLS validation path is not vulnerable.

Ensure that certificate revocation verification remains enabled (do not disable isCertRevocationVerify). The default product configuration already enables this check, mitigating the vulnerability. No patch is explicitly mentioned; the issue is mitigated by configuration. On the server side, the default TomcatJSS configuration uses a different trust manager (JSSNativeTrustManager) that is not affected. Review your configuration to avoid disabling revocation checking.