EUVD-2026-64826
GHSA-vc6r-2f9f-w5j6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
MITM positioning required drives AC:H; no target authentication needed (PR:N); confidentiality high for intercepted TLS, integrity low for certificate forgery, availability unaffected.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.
AnalysisAI
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must simultaneously be true for exploitation to succeed: (1) the target application must use JSS's JSSTrustManager for TLS certificate chain validation, and (2) certificate revocation checking must have been explicitly disabled in the application or system configuration - this is a non-default state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score and AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N vector reflect a network-reachable but high-complexity attack: no authentication to the target is required, but the attacker must achieve man-in-the-middle network positioning (AC:H) and the target must be running in a non-default configuration with certificate revocation checking explicitly disabled. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network man-in-the-middle capability - via ARP spoofing, rogue AP, or compromised routing infrastructure - intercepts a TLS connection initiated by a PKI client using JSS with revocation checking disabled. The attacker presents a forged certificate chain rooted in a certificate that exists in the target's NSS database but was never granted TRUSTED_CA flags; because JSSTrustManager omits flag verification, the client accepts the chain. … |
| Remediation | No specific fixed version has been confirmed in the available data; the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-78323 should be monitored for patch release and applied as soon as available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today