What is the CVSS score of CVE-2026-75803?

CVE-2026-75803 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-75803?

Within 24 hours, identify all systems running OpenSSL versions 3.0-4.0 and audit which applications use AEAD encryption modes (specifically AES-OCB or ChaCha20-Poly1305) via the EVP_Cipher() API. Within 7 days, apply vendor-released OpenSSL security patches to remediate this vulnerability on all affected systems and update any downstream applications or libraries with dependencies on vulnerable OpenSSL versions. Within 30 days, validate patch deployment across all systems and conduct cryptographic testing to verify that authentication mechanisms are functioning correctly.

OpenSSL CVE-2026-75803

Q: Which versions of OpenSSL are affected by CVE-2026-75803?

OpenSSL 3.0-4.0 contains a critical flaw in authenticated encryption that allows attackers to forge encrypted messages without detection, directly compromising data integrity across systems using…. A patch is available.

EUVD-2026-65488 CRITICAL

Improper Validation of Integrity Check Value (CWE-354)

2026-08-25 vendor:ubuntu

GHSA-vr27-9w4v-hjw2

Information Disclosure OpenSSL Red Hat

Critical

Disputed · 9.1 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Position in AEAD message path
Delivery

Craft empty ciphertext with forged tag
Exploit

EVP_Cipher() skips tag verification
Execution

Forged message accepted as authentic
Impact

Integrity/authentication bypass

Vulnerability Assessment

Weakness	CWE CWE-354 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V15 - Secure Coding and Architecture Integrity verification
Exploitation Conditions	Exploitation requires the target application to use OpenSSL's low-level EVP_Cipher() API with an AEAD cipher - specifically AES-OCB or ChaCha20-Poly1305 - where a zero-length input is passed and the tag is expected to be generated/verified implicitly. What limits exploitation: applications using the standard EVP_EncryptUpdate/EVP_DecryptFinal flow with explicit tag handling are not affected, and the attack is a forgery of empty-ciphertext messages, so its practical value depends on the surrounding protocol accepting empty authenticated payloads. The attacker must be able to inject or alter AEAD messages in the protocol's data path.
Impact	The input CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) rates this critical, but the signals are mixed. The real impact is an integrity/authenticity break (AEAD forgery), so C:H is questionable - a forgery of an empty message primarily undermines integrity, not confidentiality, and the input 'Information Disclosure' tag conflicts with CWE-354. EPSS is very low (0.12%, 2nd percentile), there is no CISA KEV listing and no public exploit identified, indicating no evidence of active or widespread exploitation. Exploitability is also conditioned on the application using the specific low-level EVP_Cipher() path with the affected AEAD ciphers, which narrows real-world reach despite OpenSSL's ubiquity. Net: a genuine correctness/security defect worth patching in normal cycles, but not an emergency drop-everything issue for most deployments; verify whether your software actually calls EVP_Cipher() before assessing exposure.
Exploit ScenarioDerived	An attacker positioned to supply or tamper with AEAD-protected messages to an application built on the vulnerable EVP_Cipher() path submits a message with empty ciphertext and a bogus/absent tag; the library returns success without verifying integrity, so the forged 'authenticated' empty message is accepted as genuine. This could let an attacker spoof authenticated empty payloads or bypass integrity checks in a custom protocol that relies on OpenSSL AEAD. No public proof-of-concept is identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 01, 2026

AEAD authentication bypass in OpenSSL 3.0-4.0 lets attackers forge valid empty-ciphertext/tag pairs when applications encrypt or decrypt via the low-level EVP_Cipher() path with AES-OCB or ChaCha20-Poly1305. A zero-length cipher update was short-circuited to return success without producing or verifying the authentication tag, breaking the integrity guarantee that AEAD is supposed to provide. No public exploit is identified at time of analysis and EPSS is low (0.12%), but the flaw is confirmed and patched by the OpenSSL project and Ubuntu.

Earlier versions of this analysis (1)

v1 Aug 25, 2026 - 10:39

AEAD authentication tag forgery in OpenSSL's EVP_Cipher() API enables an attacker to produce a cryptographically valid authentication tag for an empty ciphertext without knowledge of the secret key, bypassing the integrity and authenticity guarantees of AEAD cipher modes such as AES-GCM or ChaCha20-Poly1305. Any application invoking EVP_Cipher() with an AEAD mode and processing empty or zero-length ciphertexts is affected. No public exploit and no CISA KEV listing have been identified at time of analysis, though the cryptographic impact - silent acceptance of forged messages - is severe for systems relying on AEAD for data authenticity.

RemediationAI

Vendor-released patch: upgrade OpenSSL to 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2 (or later) matching your branch, per the OpenSSL advisory (https://openssl-library.org/news/secadv/20260825.txt) and Ubuntu USN-8678-1 (https://ubuntu.com/security/notices/USN-8678-1). Distro users should apply the packaged libssl/libcrypto updates and restart services that link OpenSSL. If you cannot patch immediately, the specific compensating control is to avoid the low-level EVP_Cipher() one-shot API for AEAD ciphers and instead use the EVP_EncryptUpdate/EVP_DecryptUpdate + EVP_EncryptFinal/EVP_DecryptFinal sequence with explicit tag set/get (EVP_CTRL_AEAD_GET_TAG/SET_TAG), which forces tag generation and verification; the trade-off is a code change in affected applications rather than a config toggle, and it only helps software you control. There is no runtime flag to disable the bug, so patching the library is the reliable fix.

Affected VersionsENISA

OpenSSL 3.0.0 <3.0.22

OpenSSL 3.6.0 <3.6.4

OpenSSL 3.5.0 <3.5.8

OpenSSL 4.0.0 <4.0.2

OpenSSL 3.4.0 <3.4.7

Affected Packages

euvd openssl fix: 3.0.22, 3.4.7, 3.5.8, 3.6.4, 4.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OpenSSL is the near-universal TLS/cryptography library. This defect lives in the FIPS/default provider AEAD cipher implementations - cipher_aes_ocb.c (AES-OCB) and cipher_chacha20_poly1305.c (ChaCha20-Poly1305). AEAD (Authenticated Encryption with Associated Data) ciphers must emit and verify a MAC/tag over the ciphertext and AAD; CWE-354 (Improper Validation of Integrity Check Value) is the root-cause class. The code treated an update call with inl==0 as a benign no-op returning 1 (success) without generating or checking the tag. The fix routes NULL/zero-length input to the Final path so the tag is always produced or verified (commits 119ab95, 3621257, 6c7aa6f, bdeb0cd, bf95f5f), and adds an ossl_prov_is_running() guard. This specifically affects code using the one-shot/low-level EVP_Cipher() API rather than the EVP_EncryptUpdate/EVP_DecryptFinal sequence.

Know when OpenSSL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)

Vendor (vendor:ubuntu) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 7.5 HIGH

AEAD empty-ciphertext forgery is a network-reachable integrity/authenticity break (I:H); confidentiality is not actually compromised (C:N) and there is no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Red Hat 3.7 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Sep 01, 2026 - 19:30 vuln.today

v2 - CVSS changed

CVSS changed

Sep 01, 2026 - 19:22 NVD

9.1 (CRITICAL)

Patch available

Aug 25, 2026 - 15:01 EUVD

CVE Published

Aug 25, 2026 - 00:00 cve.org

LOW

DescriptionCVE.org

AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Executive ViewAI

Why It Matters

OpenSSL 3.0-4.0 contains a critical flaw in authenticated encryption that allows attackers to forge encrypted messages without detection, directly compromising data integrity across systems using these versions. While current exploitation remains limited (0.1% EPSS, no public exploits), the severity of the flaw and OpenSSL's ubiquitous role in enterprise encryption makes this a critical remediation priority.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 98% exploitable

Prevalence

Ubiquitous

OpenSSL is the de facto cryptography library across nearly all environments

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2021-3711 CRITICAL Act Now POC

9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH Act Now

7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

CVE-2015-4000 LOW Monitor POC

3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-354 – Improper Validation of Integrity Check Value

View all

CVE-2023-48795 MEDIUM POC

5.9

CVE-2024-3596 CRITICAL

9.0

CVE-2023-33668 CRITICAL POC

9.8

CVE-2026-50021 HIGH POC

8.1

CVE-2022-36174 HIGH POC

8.1

CVE-2019-13496 HIGH POC

8.1

CVE-2024-51141 HIGH POC

7.8

CVE-2023-38802 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container suse/ltss/sle15.5/sle15:15.5-8.67	Affected
Container suse/ltss/sle15.6/bci-base-fips:15.6-35.94	Affected
Container suse/ltss/sle15.6/sle15:15.6-5.86	Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest	Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.1/base-os-container:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-75803 ADVISORY https://seclists.org/oss-sec/2026/q3/571 ADVISORY https://ubuntu.com/security/notices/USN-8678-1 ADVISORY https://vuldb.com/vuln/395050 REF https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42 REF https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b REF https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a REF https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34 REF https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9 REF https://openssl-library.org/news/secadv/20260825.txt

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Container suse/sl-micro/6.1/kvm-os-container:latest Container suse/sl-micro/6.1/rt-os-container:latest	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise Micro 5.3	Affected
SUSE Linux Enterprise Micro 5.4	Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP4-LTSS	Affected
SUSE Linux Enterprise Server 15 SP4-LTSS	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Affected
SUSE Linux Micro 6.2	Affected
SUSE Manager Proxy LTS 4.3	Affected
SUSE Manager Retail Branch Server LTS 4.3	Affected
SUSE Manager Server LTS 4.3	Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Not-Affected
SLES15-SP6-CHOST-BYOS	Not-Affected
SLES15-SP6-CHOST-BYOS	Affected
SLES15-SP6-CHOST-BYOS-Aliyun	Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun	Affected
SLES15-SP6-CHOST-BYOS-Azure	Not-Affected
SLES15-SP6-CHOST-BYOS-Azure	Affected
SLES15-SP6-CHOST-BYOS-EC2	Not-Affected
SLES15-SP6-CHOST-BYOS-EC2	Affected
SLES15-SP6-CHOST-BYOS-GCE	Not-Affected
SLES15-SP6-CHOST-BYOS-GCE	Affected
SLES15-SP6-CHOST-BYOS-GDC	Not-Affected
SLES15-SP6-CHOST-BYOS-GDC	Affected
SLES15-SP6-CHOST-BYOS-SAP-CCloud	Not-Affected
SLES15-SP6-CHOST-BYOS-SAP-CCloud	Affected