Imprivata Enterprise Access Management
Monthly
Imprivata Enterprise Access Management at version 26.2.6 and earlier ships with no capability to rotate the RSA key pair it uses when generating X.509 certificates, so the same static private key can remain in service indefinitely. An attacker cannot exploit this over the network to steal data on its own; the exposure only materializes if that long-lived key is separately obtained through theft, insider access, or eventual cryptanalysis, after which past and future certificate-based trust relationships could be undermined. There is no public exploit identified at time of analysis and no evidence of active exploitation, and EPSS rates the issue at roughly 0.07 percent (0th percentile), consistent with this being a cryptographic lifecycle and hygiene deficiency rather than a directly exploitable remote flaw.
Imprivata Enterprise Access Management at version 26.2.6 and earlier ships with no capability to rotate the RSA key pair it uses when generating X.509 certificates, so the same static private key can remain in service indefinitely. An attacker cannot exploit this over the network to steal data on its own; the exposure only materializes if that long-lived key is separately obtained through theft, insider access, or eventual cryptanalysis, after which past and future certificate-based trust relationships could be undermined. There is no public exploit identified at time of analysis and no evidence of active exploitation, and EPSS rates the issue at roughly 0.07 percent (0th percentile), consistent with this being a cryptographic lifecycle and hygiene deficiency rather than a directly exploitable remote flaw.