Multiple vulnerabilities in OpenSSL (August 26, 2026)
Multiple vulnerabilities have been discovered in OpenSSL. They allow an attacker to cause remote denial of service and security policy bypass.
CSIRTS triage
- What
- Multiple vulnerabilities allow remote denial of service and security policy bypass in OpenSSL.
- Who is affected
- OpenSSL deployments using affected versions.
- Urgency
- Moderate; denial of service and policy bypass issues present, no exploitation reported.
- Action
- Apply OpenSSL security updates from the vendor.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenSSL
Get an email when a new OpenSSL advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1079/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-630740.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630730.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-144570.98% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 60% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630750.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-630761.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-187981.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 72% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-758030.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-548740.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630720.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-63074 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63073 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-14457 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63075 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63076 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18798 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75803 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54874 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63072 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilitiescert-bund
- medium[NEW] [medium] OpenSSL: Multiple vulnerabilitiescert-bund
- unknownUSN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilitiesubuntu
- unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu
- unknownCVE-2026-75803: Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report su…nvd
- highCVE-2026-63076: Issue summary: OpenSSL CMP password based protection verification only checks whether the prot…nvd
- highCVE-2026-63075: Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-elici…nvd
- mediumCVE-2026-63074: Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificate…nvd
- unknownCVE-2026-63073: Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguis…nvd
- highCVE-2026-63072: Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the…nvd
- highCVE-2026-54874: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress cau…nvd
- highCVE-2026-18798: Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel crea…nvd
Recent advisories for OpenSSL
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- medium[NEW] [medium] OpenSSL: Vulnerability enables denial of servicecert-bund · 2026-08-26
- medium[NEW] [medium] OpenSSL: Multiple vulnerabilitiescert-bund · 2026-08-26
- unknownOpenSSL security advisory (AV26-846)cccs · 2026-08-25
- unknownUSN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilitiesubuntu · 2026-08-25
- unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu · 2026-08-25
- highCVE-2026-63076: Issue summary: OpenSSL CMP password based protection verification only checks whether the prot…nvd · 2026-08-25
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Apache Tomcat (August 26, 2026)2026-08-26
- unknownMultiple vulnerabilities in Veeam products (August 26, 2026)2026-08-26
- unknownVulnerability in Apereo CAS (August 26, 2026)2026-08-26
- unknownMultiple vulnerabilities in SonicWall NetExtender (August 26, 2026)2026-08-26
- unknownMultiple vulnerabilities in Google Chrome (August 26, 2026)2026-08-26