CVE-2026-78323: Improper Certificate Validation in Red Hat Red Hat Certificate System 10
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.
AI Analysis
Technical Summary
The vulnerability exists in the JSSTrustManager class of JSS, which does not check NSS trust flags when validating CA certificates. Consequently, certificates present in the NSS database without TRUSTED_CA flags can be accepted as trust anchors for TLS connections. This can allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections if certificate revocation checking is disabled. The default product configuration enables revocation verification (certChainRevokeVerify), mitigating this issue. The server-side TLS validation path uses a different trust manager (JSSNativeTrustManager) that properly verifies trust flags and is unaffected.
Potential Impact
If an environment disables certificate revocation checking (a non-default and unsupported configuration), an attacker could perform man-in-the-middle attacks by forging certificates accepted as trusted by PKI client connections. This could lead to confidentiality compromise and limited integrity impact. Default configurations are not affected due to enabled revocation verification. Server-side TLS validation is not impacted.
Mitigation Recommendations
No patch or official fix is currently confirmed. The vulnerability is mitigated in default configurations by the enabled certificate revocation verification (certChainRevokeVerify). It is strongly recommended to ensure that certificate revocation verification remains enabled (do not disable isCertRevocationVerify). On the server side, use the default TomcatJSS configuration which employs JSSNativeTrustManager, not affected by this flaw. Avoid non-default configurations that disable revocation checking. Monitor the Red Hat advisory for updates on patch availability.
CVE-2026-78323: Improper Certificate Validation in Red Hat Red Hat Certificate System 10
Description
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the JSSTrustManager class of JSS, which does not check NSS trust flags when validating CA certificates. Consequently, certificates present in the NSS database without TRUSTED_CA flags can be accepted as trust anchors for TLS connections. This can allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections if certificate revocation checking is disabled. The default product configuration enables revocation verification (certChainRevokeVerify), mitigating this issue. The server-side TLS validation path uses a different trust manager (JSSNativeTrustManager) that properly verifies trust flags and is unaffected.
Potential Impact
If an environment disables certificate revocation checking (a non-default and unsupported configuration), an attacker could perform man-in-the-middle attacks by forging certificates accepted as trusted by PKI client connections. This could lead to confidentiality compromise and limited integrity impact. Default configurations are not affected due to enabled revocation verification. Server-side TLS validation is not impacted.
Mitigation Recommendations
No patch or official fix is currently confirmed. The vulnerability is mitigated in default configurations by the enabled certificate revocation verification (certChainRevokeVerify). It is strongly recommended to ensure that certificate revocation verification remains enabled (do not disable isCertRevocationVerify). On the server side, use the default TomcatJSS configuration which employs JSSNativeTrustManager, not affected by this flaw. Avoid non-default configurations that disable revocation checking. Monitor the Red Hat advisory for updates on patch availability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-24T09:04:49.283Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-78323","vendor":"Red Hat"}]
Threat ID: 6a8c2986acd9273b49709061
Added to database: 08/24/2026, 11:22:46 UTC
Last enriched: 08/24/2026, 11:37:21 UTC
Last updated: 08/24/2026, 12:07:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.