What is the CVSS score of EUVD-2026-35486?

EUVD-2026-35486 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-35486?

Yes, a patch is available for EUVD-2026-35486. Update the affected software to the latest version immediately.

OpenSSL EUVD-2026-35486

| CVE-2026-42769 MEDIUM

Improper Certificate Validation (CWE-295)

2026-06-09

GHSA-rpj2-p5pj-r33v

OpenSSL Information Disclosure

5.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SUSE

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Red Hat

5.9 LOW

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 09, 2026 - 21:39 vuln.today

Analysis Generated

Jun 09, 2026 - 21:39 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 09, 2026 - 11:43 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 11:43 nvd

MEDIUM 5.3

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

AnalysisAI

Trust anchor substitution in OpenSSL's CMP rootCaKeyUpdate handler allows a network-positioned attacker with low privileges to bypass certificate validation via a cert/issuer field confusion bug (CWE-295), affecting four actively maintained OpenSSL branches. The high confidentiality impact (C:H) reflects the potential for a substituted malicious trust anchor to undermine TLS certificate chains, enabling downstream interception of protected communications. No public exploit identified at time of analysis; vendor patch released 2026-06-09 across all affected branches.

Technical ContextAI

The Certificate Management Protocol (CMP, RFC 4210) is used for automated PKI lifecycle management including root CA key rollovers, which are handled by the rootCaKeyUpdate CMP operation. OpenSSL's CMP implementation contains a code-level typo that references the cert field where the issuer field should be used (or vice versa) during rootCaKeyUpdate trust anchor validation, causing the new root CA certificate to be accepted without properly verifying its chain to the existing trust anchor. This is classified as CWE-295 (Improper Certificate Validation), a root cause class in which certificate authenticity checks are incomplete or incorrectly implemented. Per EUVD-2026-35486, affected versions span four OpenSSL branches: 4.0.0, 3.5.0-3.5.6, 3.4.0-3.4.5, and 3.6.0-3.6.2. The vulnerability is isolated to the CMP code path and does not affect standard TLS, X.509, or general cryptographic operations in OpenSSL.

RemediationAI

Upgrade to the vendor-released patched versions: OpenSSL 4.0.1 (for 4.0.x users), 3.6.3 (for 3.6.x users), 3.5.7 (for 3.5.x users), or 3.4.6 (for 3.4.x users), as confirmed by the OpenSSL security advisory at https://openssl-library.org/news/secadv/20260609.txt and the GitHub release at https://github.com/openssl/openssl/releases/tag/openssl-4.0.1. Ubuntu users should apply USN-8414-1 via the standard APT package manager. For organizations unable to patch immediately, disable or restrict the use of OpenSSL's CMP client functionality - specifically any rootCaKeyUpdate operations - until the patch is applied; note this will interrupt automated CA key rollover workflows and require manual PKI procedures as a trade-off. If CMP must remain active, isolate CMP traffic to a tightly controlled network segment with strict access controls and authenticated CMP server verification to reduce attacker positioning opportunities. Three source code fixes are tracked via NVD commits: 54d0989, 777b363, d35cd47, and d531f21 in the openssl/security repository.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

CVE-2014-3470 MEDIUM This Month

4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before

CVE-2017-3730 HIGH Act Now POC

7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

CVE-2016-8610 HIGH Act Now

7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto

Same weakness CWE-295 – Improper Certificate Validation

View all

CVE-2015-3152 MEDIUM POC

5.9

CVE-2017-2800 CRITICAL POC

9.8

CVE-2014-1266 HIGH POC

7.4

CVE-2022-47758 CRITICAL POC

9.8

CVE-2025-68121 CRITICAL POC

10.0

CVE-2025-29331 CRITICAL POC

9.8

CVE-2025-32878 CRITICAL POC

9.8

CVE-2024-3738 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2023-4966 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected

EUVD-2026-35486 vulnerability details – vuln.today

Back

OpenSSL EUVD-2026-35486

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in OpenSSL

Same weakness CWE-295 – Improper Certificate Validation

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code