Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-109399

SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fix or patch referenced
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.

Affected versions

  • sbabic swupdate

    through 2026.05.1

References 5

groups.google.com

GitHub · sbabic/swupdate

vulncheck.com