[UPDATE] [high] OpenSSL: Multiple Vulnerabilities
An attacker can exploit multiple vulnerabilities in OpenSSL to execute arbitrary code, bypass security measures, disclose confidential information, manipulate data, or cause a denial-of-service condition.
CSIRTS triage
- What
- Multiple vulnerabilities in OpenSSL can allow arbitrary code execution, security bypass, information disclosure, and denial-of-service.
- Who is affected
- Users of OpenSSL are affected by these vulnerabilities.
- Urgency
- Remediation is urgent due to the high severity and potential for exploitation.
- Action
- Update to the latest version of OpenSSL.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenSSL
Get an email when a new OpenSSL advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1852
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-341801.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 60% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-341810.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-341820.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-341831.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-351880.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-427641.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-427650.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-427661.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-427670.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-427680.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
- high[NEW] [high] IBM App Connect Enterprise: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0307 [1.00] [M/H] Vulnerabilities resolved in Oracle Database Productsncsc-nl
- unknownMultiple vulnerabilities in Stormshield Network Security (August 14, 2026)cert-fr-avis
- high[NEW] [high] Oracle Solaris third-party components: Multiple vulnerabilitiescert-bund
- highCVE-2026-42765: CVE-2026-42765msrc
- highCVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Pathmsrc
- mediumCVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryptionmsrc
- highCVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryptionmsrc
- mediumCVE-2026-35188: Double-free When Checking OCSP Stapled Responsemsrc
- highCVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversionmsrc
- highCVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handlermsrc
Recent advisories for OpenSSL
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownOpenSSL security advisory (AV26-846)cccs · 2026-08-25
- unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu · 2026-08-25
- highCVE-2026-63076: Issue summary: OpenSSL CMP password based protection verification only checks whether the prot…nvd · 2026-08-25
- highCVE-2026-63075: Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-elici…nvd · 2026-08-25
- mediumCVE-2026-63074: Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificate…nvd · 2026-08-25
- unknownCVE-2026-63073: Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguis…nvd · 2026-08-25
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
- medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
- medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25