[NEW] [medium] OpenSSL: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in OpenSSL to circumvent security measures, manipulate or disclose data, or cause a denial-of-service condition.
CSIRTS triage
- What
- Multiple vulnerabilities in OpenSSL allow attackers to circumvent security measures, disclose data, or cause denial-of-service.
- Who is affected
- All systems and applications using vulnerable versions of OpenSSL.
- Urgency
- Medium priority; OpenSSL is widely used in critical infrastructure and applications, making patching essential.
- Action
- Update OpenSSL to the latest patched version addressing all identified CVEs.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenSSL
Get an email when a new OpenSSL advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3005
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-144570.98% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 60% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-187981.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 72% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-548740.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630720.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630730.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630740.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630750.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-630761.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-758030.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-14457 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18798 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54874 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63072 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63073 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63074 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63075 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63076 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75803 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in OpenSSL (August 26, 2026)cert-fr-avis
- unknownUSN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilitiesubuntu
- unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu
- unknownCVE-2026-75803: Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report su…nvd
- highCVE-2026-63076: Issue summary: OpenSSL CMP password based protection verification only checks whether the prot…nvd
- highCVE-2026-63075: Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-elici…nvd
- mediumCVE-2026-63074: Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificate…nvd
- unknownCVE-2026-63073: Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguis…nvd
- highCVE-2026-63072: Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the…nvd
- highCVE-2026-54874: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress cau…nvd
- highCVE-2026-18798: Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel crea…nvd
Recent advisories for OpenSSL
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- medium[NEW] [medium] OpenSSL: Vulnerability enables denial of servicecert-bund · 2026-08-26
- unknownMultiple vulnerabilities in OpenSSL (August 26, 2026)cert-fr-avis · 2026-08-26
- unknownOpenSSL security advisory (AV26-846)cccs · 2026-08-25
- unknownUSN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilitiesubuntu · 2026-08-25
- unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu · 2026-08-25
- highCVE-2026-63076: Issue summary: OpenSSL CMP password based protection verification only checks whether the prot…nvd · 2026-08-25
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilities2026-08-26
- low[NEW] [low] Insyde UEFI Firmware: Vulnerability allows unspecified attack2026-08-26
- medium[NEW] [medium] OPNsense: Vulnerability allows bypass of security measures2026-08-26
- high[NEW] [high] DNN: Multiple vulnerabilities2026-08-26
- medium[NEW] [medium] SQLite: Vulnerability allows denial of service2026-08-26