CVE-2026-90647 is a critical vulnerability in Kalkitech ASE2000 V2 Communication Test Set (versions 2.35 to 2.37) affecting the IEC 60870-5-104 TLS client in Task Mode. The vulnerability arises from improper certificate validation (CWE-295), which allows a network attacker to bypass TLS certificate checks by presenting a certificate containing multiple faults simultaneously. This bypass enables the attacker to intercept and potentially manipulate protected communications via a MitM attack.

An attacker positioned on the network can exploit this vulnerability to bypass TLS certificate validation, compromising the confidentiality and integrity of communications between the client and server. This enables Man-in-the-Middle attacks that can intercept, modify, or inject data into the protected communication channel.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to trusted entities and monitoring for suspicious network activity related to the affected product.