CVE-2026-86231: Improper Check for Certificate Revocation in mwiede jsch
Description
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
CVSS v4.0
Score 6.3medium
Affected software
mwiede
jsch
cpe:2.3:a:mwiede:jsch:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-86231 affects the mwiede jsch library up to version 2.28.5 in the getRevokedKeys function of src/main/java/com/jcraft/jsch/KnownHosts.java. The flaw is an improper check for certificate revocation caused by manipulation of the known_hosts argument. This can allow remote attackers to bypass certificate revocation checks. The attack complexity is high, and no privileges or user interaction are required. A patch identified by commit 194a2f76a5c0f1c3f778565be3fd66bcafc42d23 is available in version 2.28.6.
Potential Impact
Successful exploitation could allow remote attackers to bypass certificate revocation checks, potentially undermining the security guarantees of certificate validation. However, the attack complexity is high and exploitability is difficult, which limits the likelihood of widespread exploitation despite the availability of a public exploit.
Mitigation Recommendations
Upgrade mwiede jsch to version 2.28.6 or later, which contains the official fix for this vulnerability. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-06T08:04:47.571Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9deeb7acd9273b4967a6bd
Added to database: 09/06/2026, 22:52:39 UTC
Last enriched: 09/14/2026, 23:40:32 UTC
Last updated: 10/21/2026, 13:20:24 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.