[UPDATE] [hoch] OpenSSL: Mehrere Schwachstellen

CSIRTS triage

What

Multiple vulnerabilities in OpenSSL enable arbitrary code execution, denial of service, and confidential information disclosure.

Who is affected

All deployments using affected OpenSSL versions.

Urgency

High severity; cryptographic library compromise is critical and affects vast infrastructure.

Action

Apply OpenSSL updates immediately to all systems and services.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-09-10

Exploitation

Not in CISA KEV at last sync

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0234

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Moderate exploitation riskCVE-2025-111874.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 91% of all EPSS-scored CVEs.
• Elevated exploitation riskCVE-2025-1546748.2% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 99% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-154680.78% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-154690.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-661990.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-681600.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-694180.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-694190.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-694200.80% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-694210.88% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 56% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownexploitedNCSC-2026-0346 [1.01] [M/H] Kwetsbaarheden verholpen in Siemens productenncsc-nl
• unknownMultiple vulnerabilities in Tenable products (August 4, 2026)cert-fr-avis
• unknownMultiple vulnerabilities in IBM products (July 31, 2026)cert-fr-avis
• criticalSiemens Desigo CCcisa
• high[UPDATE] [high] Oracle MySQL: Multiple vulnerabilitiescert-bund
• unknownMultiple vulnerabilities in Tenable Security Center (July 21, 2026)cert-fr-avis
• medium[UPDATE] [medium] Xerox FreeFlow Print Server: Multiple vulnerabilities allow unspecified attackcert-bund
• unknownMultiple vulnerabilities in IBM products (June 26, 2026)cert-fr-avis
• unknownMultiple vulnerabilities in Tenable Identity Exposure (June 24, 2026)cert-fr-avis
• unknownSiemens Products using OpenSSLcisa

Recent advisories for OpenSSL

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• medium[UPDATE] [mittel] OpenSSL und LibreSSL: Mehrere Schwachstellencert-bund · 2026-09-10
• medium[UPDATE] [mittel] Golang Go "FIPS OpenSSL": Schwachstelle ermöglicht nicht spezifizierten Angriffcert-bund · 2026-09-10
• medium[UPDATE] [mittel] OpenSSL: Mehrere Schwachstellencert-bund · 2026-09-10
• high[UPDATE] [hoch] OpenSSL: Mehrere Schwachstellencert-bund · 2026-09-09
• lowCVE-2026-80230: OpenSSL pinning bypassmsrc · 2026-09-08
• highCVE-2026-80229: OpenSSL provider use-after-freemsrc · 2026-09-08

More from CERT-Bund (BSI) Security Advisories

• medium[UPDATE] [mittel] vim: Mehrere Schwachstellen2026-09-10
• medium[UPDATE] [mittel] ffmpeg: Mehrere Schwachstellen ermöglichen Codeausführung und DoS2026-09-10
• high[UPDATE] [hoch] ffmpeg: Mehrere Schwachstellen2026-09-10
• medium[UPDATE] [mittel] Unbound: Mehrere Schwachstellen2026-09-10
• high[UPDATE] [hoch] Internet Systems Consortium BIND: Mehrere Schwachstellen2026-09-10