FORT Validator CVE-2026-53499

Exploitation requires the attacker to control a delegated Certificate Authority that shares the same Trust Anchor Locator (TAL) as the victim CA within the RPKI hierarchy - this is the explicit AT:P (Attack Requirements: Present) condition in the CVSS 4.0 vector, meaning the attacker must hold a legitimate CA credential issued by the same RPKI trust anchor (e.g., ARIN, RIPE NCC, APNIC) that the victim operator uses. The victim FORT Validator instance must have HTTP/RRDP enabled, which is the default configuration; operators who have already set --http.enabled=false are not exposed. No authentication to the FORT Validator process itself is required - the attack is delivered via the attacker's RPKI repository feed over the network. Exploitation is inherently limited to parties with valid RPKI delegations under a shared TAL, excluding unauthenticated external parties or those without Regional Internet Registry membership. The attack produces no immediate observable error on the attacker's side and is triggered passively by the victim's own next scheduled publication.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H) scores 7.2, reflecting low attack complexity once preconditions are met, high integrity impact on the FORT instance itself (VI:H), and high integrity and availability impact on subsequent systems (SI:H/SA:H) - specifically the BGP routing infrastructure consuming FORT's VRP output. The AT:P metric is the primary risk limiter: an attacker must hold a legitimate delegated CA certificate under the same Trust Anchor Locator as the victim, which requires registration with an RPKI trust anchor such as a Regional Internet Registry. This restricts opportunistic or mass exploitation; the realistic threat actor is a rogue or compromised RPKI participant within the same routing registry. No CISA KEV listing and no public POC exist in available data, so active exploitation is not confirmed. No EPSS score was provided, preventing quantitative exploitation-frequency assessment. Despite the niche attacker profile, the downstream consequence - silent invalidation of RPKI origin validation for targeted IP prefixes - carries significant BGP security implications disproportionate to what frequency-based metrics would suggest.

An attacker who has obtained a delegated CA certificate under the same Trust Anchor Locator as a victim ISP publishes an RRDP notification document that contains the victim CA's public RRDP snapshot URL instead of their own. When FORT Validator next polls the attacker's CA feed, it fetches the victim's snapshot via the attacker's notification and stores the victim's URL in its local cache as a successful download. On the victim CA's next routine publication - requiring no further attacker action - FORT's cache invalidation detects the URL as stale, deletes the victim's cached snapshot, and silently drops all of the victim's VRPs from its output, leaving the victim's IP prefixes unprotected from BGP route hijacking. No public POC has been identified at time of analysis.