Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Denial of Service.
CVE-2026-118147 is a vulnerability in Microsoft Visual Studio 2017 version 15.9 involving improper certificate validation. This flaw allows an unauthorized attacker to perform network spoofing attacks. The vulnerability affects multiple version ranges of Visual Studio 2017 and related versions, with official patches available to address the issue.
CVE-2026-118697 is a critical vulnerability in JetBrains Toolbox App and several JetBrains IDEs where the jetbrainsd daemon improperly validates certificates, trusting compromised intermediate certificates. This affects versions before the specified fixed releases. The flaw allows an attacker to potentially perform man-in-the-middle attacks, compromising confidentiality, integrity, and availability.
CVE-2026-112816 is a critical vulnerability in Canonical LXD affecting versions 4.0.14 through before 4.0.15, 5.0.10 through before 5.0.11, 5.21.8 through before 5.21.9, and 6.9 through before 6.10.1. It involves improper certificate validation in the HTTPS listener, allowing an unauthenticated attacker to impersonate any trusted client. This flaw enables full access to the cluster and managed virtual machines via a crafted certificate chain. The issue is fixed in versions 4.0.15, 5.0.11, 5.21.9, and 6.10.1.
CVE-2026-92744 is a high-severity vulnerability in Delinea Privilege Manager where the agent lacks proper authentication for critical functionality. This flaw allows a remote unauthenticated attacker to execute arbitrary code with LocalSystem privileges under certain conditions. The affected versions include 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows improper enforcement of the basicConstraints.pathLenConstraint in X.509 CA certificates when the keyUsage extension is missing. This flaw could enable an attacker with access to a path-length-constrained CA's private key or a subordinate CA certificate to create a certificate chain that exceeds the declared path length yet still passes verification. The issue is fixed in version 1.4.1.
CVE-2026-118780 is a vulnerability in the node-forge library (also known as Forge), a JavaScript implementation of Transport Layer Security. Versions prior to 1.4.1 improperly handle certificate chain verification when certificates share the same subject name. This flaw can cause the CA store to be modified incorrectly, removing trusted CA certificates permanently and resulting in persistent availability issues for applications reusing the store. The issue is fixed in version 1.4.1.
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
CVE-2026-105031 is a critical vulnerability in Apache Qpid Proton C up to version 0.40.0 involving improper certificate validation when using the OpenSSL TLS implementation. The affected APIs add to rather than replace the default system trust anchors, potentially causing the application to trust unexpected peer certificates. This issue does not affect the Win32 SChannel TLS implementation. The vulnerability is fixed in version 0.41.1.
Checkmk versions prior to 2.5.0p18, 2.4.0p39, and 2.3.0p52, including version 2.2.0 (EOL), contain an improper certificate validation vulnerability. The issue arises because the bundled Certificate Authority stores, using "certifi" and "webpki-roots", include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are publicly known. This flaw can undermine the trust model of TLS connections in affected versions.
CVE-2026-116641 is a vulnerability in MongoDB Database Tools prior to version 100.20.0 caused by improper certificate validation. The tools rely on Golang's TLS implementation, which uses a denylist of known-bad CA certificates. Versions compiled with Golang 1.26.8 lack the updated denylist that includes eMudhra certificates, leading to potential trust of revoked or malicious certificates. This issue is fixed in Database Tools version 100.20.0, which is compiled with Golang 1.27.3 containing the updated denylist.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.
CVE-2026-87880 is a vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 involving improper SSL certificate validation in one component. This flaw can lead to sensitive information disclosure. The issue is fixed in build 42587.
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.
CVE-2026-111459 is an improper certificate validation vulnerability in Moxa Remote Connect Suite (MRC Client) versions 1.0.0 through 4.2.0. This flaw allows an unauthenticated attacker with on-path access to impersonate a trusted server and perform a man-in-the-middle attack, potentially compromising communication confidentiality and integrity.
CVE-2025-13833 is a high-severity vulnerability in Forescout Technologies SecureConnector for Windows. It occurs when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted-server entries, some of which omit TLS certificate fingerprints. This improper certificate validation allows an attacker controlling the network to redirect traffic to a malicious server. The attacker can then execute arbitrary commands as SYSTEM via the agent’s built-in features, gaining full administrative control and potentially disabling endpoint protections or exfiltrating data. The vulnerability affects versions before 11.3.20 and has been fixed in version 11.3.20.
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.