JSS EUVD-2026-64826

Two specific conditions must simultaneously be true for exploitation to succeed: (1) the target application must use JSS's JSSTrustManager for TLS certificate chain validation, and (2) certificate revocation checking must have been explicitly disabled in the application or system configuration - this is a non-default state. The attacker must also occupy a man-in-the-middle network position between the PKI client and its TLS peer, which requires network-layer access (ARP/DNS spoofing, rogue gateway, compromised network device). The CVSS PR:N metric confirms no authentication to the target system is required for the exploit itself. Exploitation is constrained by: the non-default revocation-checking-disabled configuration, the requirement for active MITM network positioning (AC:H), and the implicit requirement that the attacker know or can guess that a usable untrusted certificate is present in the target's NSS database.

The CVSS 6.5 score and AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N vector reflect a network-reachable but high-complexity attack: no authentication to the target is required, but the attacker must achieve man-in-the-middle network positioning (AC:H) and the target must be running in a non-default configuration with certificate revocation checking explicitly disabled. These two constraints together meaningfully reduce the at-risk population below what raw CVSS severity implies. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. KEV status is absent and no public exploit code has been identified, indicating no confirmed active exploitation at time of analysis. The primary real-world risk is targeted interception of PKI client TLS sessions in environments - such as Red Hat Certificate System deployments - that have administratively disabled revocation checking, a practice sometimes adopted to avoid CRL/OCSP latency or availability dependencies. This is a real vulnerability requiring remediation, but its priority is materially lower than a PR:N/AC:L flaw; organizations not using JSS in revocation-disabled configurations face negligible exposure.

An attacker with network man-in-the-middle capability - via ARP spoofing, rogue AP, or compromised routing infrastructure - intercepts a TLS connection initiated by a PKI client using JSS with revocation checking disabled. The attacker presents a forged certificate chain rooted in a certificate that exists in the target's NSS database but was never granted TRUSTED_CA flags; because JSSTrustManager omits flag verification, the client accepts the chain. The attacker can then decrypt intercepted session traffic (high confidentiality impact) and potentially inject forged responses (low integrity impact). No public exploit code is known, and successful exploitation requires advance knowledge of the target's NSS database state.