CVE-2026-63073VulnerabilityPublished 10/22/2026
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
Source Zero Day Initiative
Severity
MediumNo CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 1.2% chance of exploitation in 30 days – higher than 66% of CVEs
What to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Description
A vulnerability in OpenSSL CMP allows remote attackers to disclose sensitive information without authentication. The issue involves the use of externally-controlled format strings. The vulnerability has a medium severity rating and is identified as CVE-2026-63073.